Binance, North Korea and the Crypto Heist Boom

Bloomberg Audio Studios.

Podcasts.

Radio. News.

It's kind of amazing that this all started in a way with a Seth Rogen movie.

It certainly is an odd part of the story that really North Korea emerged on the international stage for many people, particularly those who aren't following the cyber world as closely because of a Seth Rogen movie.

I'm Sarah Holder, and this is The Big Take from Bloomberg News. Today on the show, Bloomberg crypto editor Ryan Weeks and Bloomberg economics analyst Adam Ferrer join me to talk about the biggest crypto heist of all time, how hackers linked to North Korea robbed roughly $ 6. 3 billion from Binance, and how stolen crypto is increasingly funding Pyongyang's nuclear ambitions.

Over the weekend, the FBI said North Korea was behind the Binance hack that got so much attention last week. Adam, is this state-sponsored hacking?

It absolutely is.

And I think that's the thing that really sets the North Korean cyber actors apart from many of the other actors operating in the space. And we may all remember when Sony suffered this massive hack from North Korea, you know, which was done as a result of their release of The Interview, a movie that saw U.S. journalists theoretically kill the North Korean leader Kim Jong-un. And, you know, that really was their kind of coming out of showing how effective North Korean cyber actors could become. But increasingly after that, they turned very much to revenue generation. And we had an attempt to steal over almost a billion dollars for the Central Bank of Bangladesh. And then eventually this transition

to this more permissive environment in cryptocurrency. And since then, North Korea has stolen in excess, excluding this year, in excess of $ 6 billion starting in 2016. And all of that is a state-sponsored directed effort to ensure that the regime has enough money to accomplish its military objectives, particularly on its nuclear and ballistic missile programs, but also to keep Kim Jong-un and the elite in the level of lifestyle that they prefer.

You mentioned how prolific North Korea has been when it comes to these kinds of crypto hacks. What's behind their strategy?

So what you have to keep in mind is that North Korea has been under international, excessive international sanctions for well over a decade now and arguably going back well into the early 2020s and late, excuse me, around 2000. And Since then, they've been working around the clock to find new ways to earn income and support the regime's ambitions, which vary but increasingly are focused on, as Kim Jong-un has put forward, the nuclear ambitions and nuclear focus of the country. And all of that has led to this effort to find creative ways to earn that income. And on the cyber side, what they've done is use the whole power of the state. So that means going into schools as early as the secondary level, identifying talented technical

students and pushing them into these pipelines to develop them further into university and then eventually being brought into the Reconnaissance General Bureau, which is North Korea's intelligence service. And the best of the best are brought up to be these cyber actors. And we have to keep in mind that the North Korean economy is minuscule compared to most countries on earth, right? GDP sits a little above $ 30 billion.

So this theft that they just accomplished, right, the largest hack in history of $ 6. 3 plus billion, accounts for almost 20% of North Korean GDP.

So the value to them is immense.

Ryan, Binance sort of sprang into action after this attack and managed to freeze some of these crypto assets. I'm wondering how much money the hackers might actually get in the end.

Mm-hmm.

So far, about half of the total $ 6 billion has been frozen, predominantly with the help of third-party partners. So stablecoin issuers have frozen the most. Tether froze $ 1. 5 billion worth of its stablecoin, USDT, and Circle froze something like $ 800 million. So they were very effective in getting partners to step in quite quickly and They also themselves, Binance that is, responded very quickly and openly. You know, they sort of talked through the process of being hacked and responding to that hack on social media. And they've been pretty widely lauded for that, which is a very strange situation that you get in crypto quite often when these exchanges get hacked for hundreds of millions of dollars or billions.

And people almost quite quickly forget the failings that led to that and focus on how good the response was. There's a very strange sort of perverse situation. They end up coming out of it. almost looking pretty, right?

Interesting.

Well, Ryan, the value of Bitcoin dropped slightly after the hack, but overall, the market response was relatively muted considering the scale of the attack. Part of that might be what you talked about, where folks pretty quickly forget the incident itself and focus on the response. But why didn't we see bigger moves in the currency?

The market is remarkably chilled, dead flat today, first day back at work, you know, since Friday when kind of most of this was panning out. And basically they believe that Binance can swallow this hack, enormous as it was, $ 6 billion. People think that Binance, which has pledged to make users whole and pretty much has already. And I think yesterday they said they'd covered 95% of losses. So it does seem that that is the case. There have been withdrawals today. And so far, they seem able to absorb those as well.

And talk about the scale of those withdrawals. Once customers regained access to their accounts, how much money have they been trying to take out?

Yes.

So withdrawals went live Sunday morning, I believe it was. And it's a little bit difficult to know the exact scale of the withdrawals because you get a figure from Binance, you see stuff on chain. But let's say at the moment, it's about net outflows of $ 5 billion.

Right.

If you couple that with the hack and also some cryptocurrency fluctuation, as I said, nothing too big, but there has been some volatility. In total, I think Binance's assets have dropped from about $ 171 billion to high $ 150 billion. It's big, but there's still a hell of a lot of assets there. We'll see how it pans out this week, but for now, withdrawals seem relatively stable.

And it's worth reminding people here that Binance.com, the main global exchange, does not serve US customers. Does that mean that US crypto holders were not impacted by this attack?

It's a good question.

I think with every crypto operation that claims to not serve US customers, you have to take it with a pinch of salt.

VPNs exist.

There probably is some VPN access going on. So it's a bit of a strange thing. But I think... Yeah, I think given the legal difficulties Binance has had in the US before, it's safe to assume that the bulk of their traders at the very least are not there.

Coming up, what will the Binance hack mean for efforts to take cryptocurrencies mainstream? I am curious what we know about the bigger picture here, because the hack is the biggest that crypto has ever seen. But there have been a few other high profile attacks this year and last. Does this point to deeper systemic vulnerabilities with crypto exchanges or was there a specific security flaw within Binance?

Well, we don't know exactly the attack vector other than that a device or employee devices, plural, were compromised. And that led to the attackers being able to take control of a key wallet or wallets that were then drained.

And do we know what compromised means in this context?

We don't. I mean, you know, if you look at past examples, on occasion it's meant that somebody interviewed an employer at a company, a crypto company, over a period of a number of weeks or months, gave them a job offer over LinkedIn or something, asked them to sign a PDF. They clicked the PDF, the PDF disappeared. has malicious software and it gets uploaded to the computer, they take control of the device, they get access to key systems that way. That's just one example. There was a really interesting example earlier this year in which a decentralized finance protocol called Drift got kind of social engineered by a team, seemingly a team of traders who got to know them at a conference, spent time talking to them

over a number of months. took them into their confidence and ultimately gained access to critical systems that way. But what we don't have yet is a very detailed kind of post-mortem from Binance of exactly how the devices got compromised. So I guess, I don't know, Adam, you probably agree, it's sort of the same flaw that most cryptocurrency exchanges that have been hacked in recent years have, which is just that it's too easy to, via social engineering, usually some kind of phishing attack, gain access to system and then from there, you know, drain wallets.

So to take us back for a second, you know, I, prior to coming to Bloomberg, sat at the White House on the National Security Council working these issues. And I remember seeing these initial hacks come across our desks and being astounded that hundreds of millions of dollars could walk out the door so easily. And, you know, seeing the limited both market impact and response from the community. And, you know, sadly, what we've seen since is that it just gets bigger and bigger and bigger. And the reality being that, yes, the cybersecurity of these firms is getting better.

I think there's no doubt about that. And certainly, I think they're leveraging the new tools that AI offers to But the fact is that the North Koreans, while considered a backwards nation by many, their hackers certainly aren't. These are teams that take careful study of their targets and use sometimes months, if not years, to prepare for some of these attacks, particularly focused on on social engineering and advanced phishing attempts. The problem in the loop continues to be the human. As long as that's the case and as long as the system itself remains so decentralized by its nature and you don't have clear security protocols that stop some of the ability of a handful of devices, employee devices to be able to enable such a large withdrawal,

The reality is that North Korea is going to keep pushing and finding new ways to pull this money. And this is a huge amount of money. The idea that any bank having that happen wouldn't see a massive run and the financial system wouldn't be in question. And yet in the crypto industry, it's nothing but a blink, it seems.

Well, the Binance attack comes at a time when President Trump and others in the U.S. have been pushing for mainstream adoption. And while institutional investors are actively invested in these digital currencies, I'm curious, what impact might this hack have on those plans and on the momentum behind more mainstream adoption of crypto, if any impact, Adam?

So far, I don't see any signs that we're going to see a major change, right? The reality seems to be that this almost seems to be breakage, right? The market just accepts that this is going to happen here and there. And as long as firms are able to kind of make people whole, in general, it's just not considered a major issue. I think the reality, though, is the question becomes, what is the line? When is it too much, right? I think I would have said $ 6 billion seems like too much. But at some point, you know, if these firms, you know, like Binance, as we've already talked about, has over $ 100 billion in assets, if $ 100 billion walks out the door, does that mean the system itself is over?

Right? I don't know.

And so for now, it certainly seems that the upside is outweighing these downside risks. And so the question for those operating in that space and willing, you know, is at what point are you unwilling to.

Make that risk?

Another interesting thing that I've seen pointed out is that sort of the value for investors in crypto is that it's this decentralized currency. But what we saw in this hack is that Binance was able to very quickly freeze these assets. Does this lay bare something about the level of control these crypto exchanges have?

Absolutely. Yeah, it's one of the big issues stemming from the fact that crypto has been so embraced by the U.S., right? If you take Tether as an example, Tether, as I mentioned, is the biggest stablecoin issuer in the world. It's stablecoin USDT. There's something like $ 180 billion worth of USDT in circulation.

It's a digital sort of synthetic representation of the dollar. And it's supposed to be increasingly popular for payments globally and things like that. And, you know, one of the great ironies of Tether as sort of a driving force of cryptocurrency is that one company can essentially decide to freeze wallets at any time. seemingly with quite a lot of discretion as well. And they've frozen over $ 5 billion worth of Tether today, and obviously another $ 1. 5 billion chunk in this incident. They can do it extremely fast. They can work with law enforcement, but they don't always. And yeah, I mean, you're absolutely right. It's not in line with the sort of cypherpunk ideals that the founding fathers of

cryptocurrency had in mind at all. But it's what they've had to do, I think, in order to be accepted in the way that they have in the US and potentially by other law enforcement agencies around the world. They've become an ally to them 100% and it's really helped them. But whether it's true cryptocurrency, I don't know.

Yeah, I can see that being both a reassuring shift and a concerning one, sort of depending on where you sit.

Absolutely.

It throws up all kinds of second-order effect questions, right? Who decides whether or not an intervention of that kind should happen? What's the process? Once currency has been frozen on a blockchain, how do you unfreeze it? How do you send money back to the victims? Who decides that? Should you charge a fee because there's some kind of legal risk to you as the stablecoin issuer? of someone else coming along and saying, actually, that's my currency you've frozen.

This absolutely happens, by the way. And there's lots of interesting legal disputes going on on exactly that topic right now.

So, Adam, there's another interesting tension here where the U.S. is embracing digital assets and wants the industry to grow, while adversaries like North Korea are seemingly exploiting the same ecosystem to raise money. Can governments have both a much bigger crypto economy and effective economic sanctions?

I mean.

Currently, the answer seems to be no.

And I think through our conversation today, we have not landed on any clear fixes to this problem. The decentralized nature of the crypto industry and the inability of anyone to regulate it continues to limit the ability of broad sectors to cut off the hacking route for earning huge amounts of income today. that tangibly change the global security situation.

And I think that's something that people should really take home with this, is that each of these dollars that the North Koreans liberate, as they would say, from these exchanges, are used in many cases to develop weaponry and systems that are designed to increase North Korea's ability to exert its.

Influence in Northeast Asia.

And, you know, again, this is a country that has developed intercontinental ballistic missiles and has nuclear weapons and has threatened the United States itself. And so as the crypto industry grows and more money flows into it, it provides more and more opportunities for malign actors with the time and patience and skill to leverage that to fill voids that have been made by traditional sanctions measures that have cut off those traditional trade mechanisms that historically were the tools of the world to try and isolate and force policy changes in countries. Now, we could have a broader debate on how effective those sanctions have ever been, but the simple reality here is that North Korea is earning

more from crypto than it ever did from many of the industries that are currently sanctioned.

This is The Big Take from Bloomberg News. I'm Sarah Holder. To get more from The Big Take and unlimited access to all of Bloomberg.com, subscribe today at Bloomberg.com slash podcast offer. Thanks for listening. We'll be back tomorrow.

Binance, North Korea and the Crypto Heist Boom

Kapitelklicken springt direkt hin

Shownotes

Transkriptvom Podcast bereitgestellt · Zeitmarken springen hin