- 13 minutes ago
Binance says a cyberattack exposed an estimated $6.3 billion in digital assets, making it the largest crypto theft to date. Analysis points to North Korean hackers. DW talks to a cybercrime expert.
Category
🗞
NewsTranscript
00:00This could be the cryptocurrency industry's biggest ever theft.
00:06Crypto giant Binance says hackers have impacted more than $6 billion worth of digital assets.
00:13And it may have happened because an engineer's laptop was compromised,
00:17allowing an attacker to make unauthorized withdrawals.
00:21We're looking at a human and just one laptop that started it all up
00:27because someone's clicked on a link that has downloaded this huge malware.
00:33Now, that's one theory of how it may have happened.
00:35But the news has rattled markets with Bitcoin, Ether and other major cryptocurrencies all falling sharply.
00:45So let's look at how this happened, who might be behind it and what it all means for the future
00:51of crypto.
00:53We're going to talk to Jake Moore about this.
00:56SE researches emerging cybersecurity and AI threats with a particular focus on future cybercrime.
01:03Jake, put this into simple terms for us.
01:06What exactly happened here?
01:09So Binance is the world's biggest crypto exchange.
01:12And it's been hit with what seemingly is the biggest heist ever, with over $6 billion stolen from it,
01:21which is absolutely huge, but worryingly, something that we may see more of in the future.
01:27Now, Binance says an engineer's laptop may have been compromised.
01:32Do we know how that happened?
01:35How hackers got into that laptop?
01:38Can you talk to us about that a little bit?
01:39Yeah, so we don't know exactly how they got into that laptop yet, but what we are seeing a bit
01:46more of in amongst the industry,
01:49particularly focusing on cryptocurrencies, is where attackers are researching for prospective employees,
01:57maybe looking to say they are headhunters, sending messages through LinkedIn or via their emails and inviting them to video
02:05calls.
02:06So, prospectively, maybe Zoom calls or Teams calls, but they might ask those individuals to download a specific download link,
02:16which will take them to something like Zoom.
02:18But when those have been looked into, they have been packed with malware that can take control of a laptop.
02:25So, worryingly, yes, this laptop was able to start the process of carrying out this huge hack.
02:32But ultimately, we're looking at a human and just one laptop that started it all up because someone's clicked on
02:42a link that has downloaded this huge malware.
02:46So, this is actually incredibly simple.
02:49So, not surprisingly, you were just saying that this, you know, this is a huge deal.
02:53This is huge.
02:54And this is going to keep happening because it's very simple.
02:59Yeah, it's very simple with very attractive amounts of money at the end of it.
03:04Now, places like LinkedIn are a shop window for attackers.
03:09They can find out who works, where, what credentials they've got.
03:13It's effectively their resume on the internet.
03:16And they can go and fine-tune it to see who would have those skills.
03:21And if you've got those skills, then you usually then have those or access to that particular type of software.
03:28And those are the people that they are targeting.
03:30So, they can easily find them.
03:32It's very simple.
03:33It's effectively open-source research and target those people.
03:36And if they download a link, which maybe seems believable, then they are likely to go ahead and do it.
03:42Now, there are suggestions that a North Korean-linked hacking group may be behind that.
03:49How likely is that?
03:51What do we know about that?
03:53Yeah, at the moment, it is highly likely.
03:56It resembles previous state-backed attacks.
04:00They are relentless in targeting companies.
04:04Funnily enough, they're not always after money.
04:06Sometimes, they're just out to go and monitor websites and huge companies to see how they operate and see what
04:15they're up to.
04:16But every so often, they're also after huge amounts of money.
04:20And this will also disrupt markets.
04:21So, it has a huge knock-on effect.
04:23But this money is often used to fund further cybercrime.
04:27They are seen as the most sophisticated out there.
04:31And this, although it may seem like a simple attack, there's a lot of sophistication behind it and a lot
04:36of knowledge to be able to carry something like this out.
04:40And their relentlessness is what is really impressive in targeting these companies.
04:46They'll continue to target with anyone they can.
04:50Say some people don't fancy a new job.
04:52If they're offered something, they continually go to the next person until they're in.
04:56But why North Korea?
04:58Why has North Korea become such a player in global cryptocurrency theft?
05:05Well, it's a way of getting a lot of money in a very short space of time.
05:09This huge $6 billion heist is supposedly meant to have taken place within 20 minutes.
05:15You can't go and steal that amount from a bank in years.
05:19It's very, very difficult in any other way of doing so.
05:22In 20 minutes, this amount of money?
05:26Yeah, in 20 minutes.
05:27Yeah.
05:27Wow.
05:28But this amount of money does move around in that short space of time.
05:32If it doesn't flag an anomaly, then it's allowed to happen.
05:38Lots of money like that is pushed around between banks and in crypto exchanges all the time.
05:43So when it looks genuine, it doesn't raise that flag and doesn't stop it in its process.
05:48But if criminals can get in and hijack that process and they're able to act like they are genuine, then
05:56it gets through.
05:58But yeah, North Korea are wanting to fund their further cybercrime in the future.
06:03And they need that currency in their bank accounts.
06:07But it's not immediate that they would get it.
06:09I know some of the money has been frozen, but when we're talking about the money they're after, it's not
06:14like it immediately goes into their back pocket and they're able to use that.
06:18A lot of this will get what we call washed.
06:20So it gets moved into different cryptocurrencies, into different exchanges, trying to kill that trail of where it is.
06:28Because you can monitor the trail of where cryptocurrencies go, it's just you don't know who owns it.
06:34Ultimately, it's how they get it into their real currency that they might be able to spot.
06:39But unfortunately, that won't be for potentially years.
06:43Right.
06:43Binance is saying that it's going to cover all losses.
06:46But let's say I'm an ordinary customer, you know, crypto, with crypto on the platform today.
06:52What should I be worried about the most?
06:56Yeah, unfortunately, this kills trust in the crypto exchange market.
07:02But on a personal level, I think people will be just worried about any form of communication.
07:08And if they're not, then they should be just in case they are to receive emails and text messages reporting
07:14to be Binance.
07:15That's the biggest threat that could happen in the next week or so.
07:19But yes, some people will be thinking about what to do with money that they have in crypto exchanges.
07:25Now, I would always advise to spread it between cold storage.
07:30That means on a physical USB, you might actually be able to hold in your hand and then choose reputable
07:36and a few crypto exchanges just to minimize that risk on a single attack.
07:42So if the biggest exchange, you know, in the world can be hit like this, what does that say about
07:48the security of the entire crypto industry?
07:52Yeah, I think that's the biggest worry here.
07:54We haven't got the greatest regulation around the world on crypto exchanges and currencies yet.
07:59The banks are trying to balance the future of crypto with the tradition of banks themselves.
08:06But unfortunately, we do have these weaknesses in the line and in their processes because those people that have access
08:14like this developer on their laptop, they require that access.
08:18And that is what's called privileged access.
08:20And they need that to run their jobs.
08:22But unfortunately, if they are compromised and manipulated in this way, then it hands over the control to someone rogue
08:30anywhere in the world.
08:31And so we do need tougher regulations.
08:34It might slow the whole process down, admittedly.
08:37But I think that's an offset.
08:39And unfortunately, something that is required, even though cryptocurrency is seen as a very fast moving way of using currency.
08:49I think we need to put those hurdles in place to minimise this in the future.
08:53Yeah.
08:54Bitcoin, we saw that Bitcoin and other major cryptocurrencies fell sharply after this news broke.
09:02I mean, could an attack like this have consequences beyond crypto investors?
09:07Are we going to see a ripple effect here?
09:10I think we always see ripple effects in any cyber attack, any cryptocurrency shifts.
09:16We can find that the C-suite of a bank might be talking about how cryptocurrency can be volatile, and
09:25that can then change market shares all over the world.
09:28These ripples are just part and part of a business.
09:31It does have this danger of the crisis in the confidence of cryptocurrencies in the future.
09:37I think investors will be probably worried about where their money is.
09:42But unfortunately, I do think we may see more attacks like this.
09:46And we've had a whole month of technology and cybersecurity issues, especially when we've got AI now looking for vulnerabilities
09:54every day.
09:56Although the good guys have also got very similar AI vulnerability tools, we've also got to expect that the bad
10:03guys have got the same tools and access to be able to carry out further attacks.
10:07So unfortunately, I think we just need to be better protected on an individual level as well as a business
10:12level.
10:13I haven't asked you about AI yet, but what you're saying is AI can help and it can also make
10:17it worse.
10:19Absolutely. We're talking both sides here. We've got AI in software that can look for those anomalies, those red flags,
10:27but equally it's looking for them on the bad side as well.
10:30So if they're quickly able to spot a vulnerability, not necessarily the part where we're seeing here with a laptop
10:36that's being compromised.
10:38If we're seeing something, maybe some errors in the code that makes up a website or a database or server
10:45or whatever, and if that is manipulated enough to be, say, affected with malware, and then that can also have
10:55that ripple into markets.
10:57Because we can see huge businesses crumble because they've been sitting on a vulnerability for years, similarly like we saw
11:04last week with PHP, where 70% of the world's websites are running on it.
11:09There was this vulnerability that was around for 12 years that no one had spotted.
11:13AI came along and spotted it straight away, then a patch is released, so it's a race to get that
11:18all updated.
11:19That, in, say, correlation to what we're seeing today, is something that I think we're going to see a lot
11:24more of.
11:25That's so interesting. What are the best and worst case scenarios from here?
11:30So are we talking about a temporary shock to confidence? You mentioned confidence earlier.
11:34Or do you think this could become one of those moments that really does change how the whole industry is
11:41regulated and is operated?
11:45Well, I think best case, we'll see funds contained and security improved.
11:50That would be fantastic and not see these single points of failure.
11:54But worst case, I do think we will see further losses.
11:58Worst case is when those losses are not reimbursed, and that will just kill the confidence again.
12:04And I think I take my hat off to Binance to say they will be reimbursing, and that's just a
12:09little bit of help to all those that have lost money if they've woken up to see their wallets drained
12:15completely.
12:16But ultimately, we need tighter regulations, and I think governments all over the world need to work together to make
12:22sure that happens.
12:23Cybersecurity and cybercrime expert Jake Moore.
12:26Jake, thank you so much for that. Really interesting.