CypherTalk

About CypherTalk

CypherTalk is a twice-monthly podcast on the realities of cybersecurity and privacy in a world that’s moving faster than our defenses. Hosted by Jade Doherty (who translates technical security into plain English) alongside rotating security and privacy experts — including co-host Stefan Beyer, co-founder of Oak Security — the show explores how modern cybersecurity attacks actually happen: not just through bugs in code, but through people, processes, supply chains, and the tools we rely on every day. The show also looks at the latest trends in privacy and its supporting technologies, such as cryptography and zero-knowledge proofs. Expect conversations that balance big-picture trends (AI-driven threats, privacy tech like zero-knowledge, shifting security standards) with practical takeaways you can apply immediately — whether you’re a developer, a founder, or simply someone who uses the internet. Less hype. More clarity. Better security and privacy habits.

Publisher

Oak Security

Category

technology

Language

en

Explicit

No

First episode

4 Feb 2026

Latest episode

2 Nov 2026

Latest episodes

21 episodes in the feed.

1. 

   2 Nov 2026

   Private Keys: Crypto’s Original Sin, with Griff Green

   Griff Green is back, about six months after his first appearance, and this time Jade and co-host Stefan Beyer get him talking about communal security and where TheDAO Security Fund has got to. Griff runs the fund, founded Giveth and DappNode, led the original DAO white-hat cleanup, and sits on the Arbitrum and ENS Security Councils. The line that sticks from this one: private keys are crypto’s original sin. Griff doesn’t hold back on it. It’s 2026, everyone’s been hacked, and the way we still onboard a new person is a raw private key and twelve seed words, where one bad click and it’s all gone. No bank works like that, because nobody would want it to. What he wants instead is vaults, smart-contract wallets, MPC setups like Turnkey (which Giveth now uses), things with daily limits, allowlists and an escape hatch if you get hacked. Non-custodial, but actually safe. He argues crypto could even be safer than a bank, because it can get rid of custodial risk entirely. First though, the fund. Round one handed out over $1.6M to 135 projects through quadratic funding, and the big lesson was how many people wanted to chip in for security, and how much they left on the table simply because they didn’t give themselves enough lead time to fundraise. So round two is built differently. Funding comes out against milestones, at least a third of every budget is tied to actual adoption, and an initiative has to raise 25% from the community before it can touch the DAO’s ~400 ETH. Then 200 Ethereum security badge holders vote on what gets funded using participatory budgeting (Stefan, to Griff’s disbelief, didn’t make the badge-holder cut). The whole design is about beating the free-rider problem: only fund the things the community actually puts money behind. The initiatives range from a privacy-preserving EDR tool to a service that screens job applicants for North Korean operatives. Then they get into the pound of cure. Griff walks through the KelpDAO exploit, how a LayerZero/RSETH issue let likely North Korean attackers borrow around $71M against duplicated collateral on Arbitrum, and how the Arbitrum Security Council stepped in with an L1 transaction to freeze it. He can’t discuss the internal debate (there’s an NDA), but he’s completely open about where he stands: on “code is law” versus stepping in, he’s an extremist, if you can stop North Korea walking off with $71M, you do it, every time. From there it widens out into the legal headaches that followed, why hackers now bridge funds off-chain to dodge exactly this kind of freeze, and a genuinely sobering stretch on how crypto’s weak security ends up funding real-world harm, from state actors to the scam compounds operating across Southeast Asia. Key Topics TheDAO Security Fund round two: milestone funding, co-funding as a filter, and badge-holder voting The KelpDAO exploit, the Arbitrum Security Council freeze, and “code is law” versus intervention Why private keys are crypto’s original sin, and the case for vaults and smart-contract wallets Chapters 00:00 Introduction and Welcoming Griff Back 01:03 Griff’s Origin Story: The DAO, Giveth, and DappNode 04:11 TheDAO Security Fund: From the 2016 Cleanup to Today 07:21 Staking Rewards, Not Principal: How the Fund Works 09:51 Round One in Review: $1.6M, 135 Projects, and the Appetite to Fund Security 11:16 Why Round Two Is Different: Lead Time and Leaving Money on the Table 14:37 Solving the Free-Rider Problem: Co-Funding as a Filter 16:52 Adoption Milestones and Starting Small Businesses, Not Just Tools 21:05 How Initiatives Are Ranked: 200 Badge Holders and Participatory Budgeting 26:27 Real-Time Results and Leaning Into Community Signal 31:43 How to Get Involved 41:44 Shared Infrastructure: Why One Team’s Weakness Hits Everyone 43:05 The KelpDAO Exploit and the Arbitrum Security Council Freeze 49:19 The Legal Challenge and the Wider Impact of Intervention 53:03 Where Griff Draws the Line on Intervention 56:16 Is Crypto a Net Positive?

2. 

   23 Oct 2026

   The Quantum Security Threat with Colton Dillion & Dr. Richard Carback from Quip Protocol

   Title: The Quantum Threat, and Learning to Love It, with Colton Dillion & Dr. Richard Carback (Quip) Jade Doherty and Stefan Beyer speak to Colton Dillion and Dr. Richard Carback of Quip, the team building what they call the worldwide quantum computer. Quip is both a fix for the post-quantum problem and a marketplace monetising idle time on quantum computers, with quantum-resistant wallets that wrap existing ones on Ethereum, Solana, and a Bitcoin L2. The heart of the episode is the timeline. Rick walks through how Quip’s Quantum Doomsday Clock lands on roughly March 2028, the collision of two underestimated forces: exponential qubit growth and error-rate reduction, which has crushed the estimated requirement from 20 million qubits to IonQ’s claimed 20,000. Stefan presses on how much is hype versus real threat in a field as closed as the AI labs, and it turns genuinely unnerving: a quantum break is indistinguishable from any ordinary hack, there are 6-7 million vulnerable Bitcoin addresses (including two Binance wallets holding ~$20B), and Colton sketches a plausible attack where someone quietly drains old whale wallets, buys puts, then reveals Satoshi’s coins have moved. But why should you “stop worrying and learn to love the quantum.”? They make the case for defense-in-depth and hybrid signatures (where the fallback is never worse than today), why this is Y2K-like, a real deadline with no fixed date, likely a large no-op precisely because serious people are acting. They cover the roadmaps underway (Bitcoin’s BIP 360, Ethereum, Solana), looming government mandates, why insurance markets will price this before regulators, and the hard problem of upgrading not one chain but every bridge, oracle, and validator set. Rick is clear that Quip is not a privacy project and isn’t inventing exotic maths, deliberately using vanilla, battle-tested constructions, because, as Stefan notes, real-world losses come from operational mistakes, not broken cryptography. The episode closes on Quip’s products (the bridgeless QuipSwap protocol Oak audited, proof of useful work, a quantum randomness function) and the brighter side of quantum: chemical modelling, materials simulation, and one day simulating the universe. Key Topics The quantum threat timeline, and why a break looks exactly like an ordinary hack Hybrid signatures, defense-in-depth, and the migration problem across chains Quip’s “worldwide quantum computer”: quantum-resistant wallets, proof of useful work, and the compute marketplace Chapters 00:00 Introduction and Two Very Different Backgrounds 02:09 What Quip Is: Post-Quantum Fix and Quantum Marketplace 04:59 From a Defense Project to “Harvest Now, Decrypt Later” 07:04 The Quantum Doomsday Clock: How You Get to March 2028 08:36 Exponential Growth, Error Rates, and the Collapsing Qubit Count 12:43 How Much Is Hype vs Real Threat? 17:24 Are the Vendors Holding Back? The Secret-Facility Question 20:40 What It Means for Blockchains: Vulnerable Addresses and a Plausible Attack 23:30 Rescuing Wallets, Zero-Knowledge Seed Proofs, and Chain Roadmaps 25:16 The Missing Deadline: Why This Is Harder Than Y2K 30:51 Privacy, Built In From the Start 35:07 Selling Quantum Security Without Fear-Marketing 38:00 Quantum Resistance as an Insurance Policy, and Government Mandates 40:36 Can Decentralised Communities Fix This in Time? 48:33 Quip’s Products: Wallets, QuipSwap, Proof of Useful Work, QVRF 53:53 Open-Source Tools for Developers 57:21 The One Thing to Do in the Next 12 Months 01:01:00 Learning to Love the Quantum: The Upside Resources and Links Colton on X: https://x.com/cadillion Rick on X: https://x.com/rcarback Quip Network: https://quip.network Oak Security’s Research: https://research.oaksecurity.io/

3. 

   6 Oct 2026

   The Brave Browser with Kyle Den Hartog

   Have you heard of Brave? Today we are joined by Kyle Den Hartog, a security engineer at the privacy browser. His path runs from penetration testing to self-sovereign identity to Web3, and that bridge between the Web2 and Web3 worlds runs through the whole conversation. They start with how Brave made privacy mainstream: sane defaults and treating privacy as an emergent property that has to be fought for at every layer, with surveillance capitalism as the threat model rather than Tor-style maximalism. From there, why the biggest problems are no longer smart-contract bugs but browser and interface attacks, and a sharp point about domain expertise: crypto wallet teams often don't realise the browser already solves their problems (MetaMask's phishing list vs Safe Browsing, Rabby leaking browsing history vs hash-prefixing). It's also why Brave built its wallet into the browser rather than as an extension. The most provocative stretch is Kyle's argument that Web3 is accidentally reintroducing cross-origin tracking. A wallet address is just a cookie: shared across sites on "connect," and far more revealing than any third-party cookie because it exposes where, when, and how much you spend. His fix is the thick client, moving transaction-building into the wallet so untrusted sites never receive the address. The conversation then ranges across why zero-knowledge proofs aren't the panacea they're treated as (the "20 questions" problem), how ZK-gated compliance can recreate the gatekeeping Web3 set out to escape, why the early internet's lack of an identity layer was a feature, and a thoughtful take on age verification. Kyle closes on what Web2 and Web3 get wrong about each other, and his practical privacy advice beyond switching to Brave: a reputable audited VPN, then moving off the platforms that track you most. Key Topics How Brave made privacy mainstream, and the browser as the real attack surface Why a wallet address is the new tracking cookie, and the "thick client" fix The limits of zero-knowledge proofs, identity, and getting age verification right Chapters 00:00 Introduction 00:35 From Penetration Testing to Self-Sovereign Identity to Brave 01:49 Making Privacy Mainstream: Sane Defaults and Emergent Privacy 04:34 The Brave Wallet, BAT, and Rethinking What the Infrastructure Is For 07:07 The Browser as Attack Surface: What Browsers Can Actually Do 10:06 Why Crypto Wallet Teams Miss What the Browser Already Solves 13:55 Why the Brave Wallet Is Built In, Not an Extension 16:02 Web2 Guy or Web3 Guy? Why Brave Over a Pure Web3 Protocol 19:05 How the Brave Wallet Compares, and the Pivot to Payments 21:56 How Web3 Is Reintroducing Cross-Origin Tracking 24:55 The Wallet as Cookie: Leaking Where You Spend Your Money 26:59 The "Thick Client" Fix 29:47 Are Zero-Knowledge Proofs a Silver Bullet? The 20 Questions Problem 34:20 Recreating Centralised Gatekeeping and the KYC Tension 38:27 Why the Early Internet Had No Identity Layer 42:00 Getting Age Verification Right: Moderation vs Who Decides 49:02 AI at Brave, and AI as a Tool 50:36 What Web2 and Web3 Get Wrong About Each Other 52:31 Practical Privacy Advice Beyond Switching to Brave 54:12 Where to Find Kyle, and What's Next for the Wallet Resources and Links Kyle on X: https://x.com/PryvitKyle Kyle's website and blog: https://kyledenhartog.com Brave: https://brave.com Oak Security's Research: https://research.oaksecurity.io/

Contact CypherTalk

Guest appearances

Books guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.