WEBVTT - 2022 Was a Good Year for Crypto Hackers 0:00:02.759 --> 0:00:05.800 This is Bloomberg Crypto, a daily Bloomberg I HUD podcast, 0:00:05.880 --> 0:00:08.760 and I'm Stacy Marie Ishmael, Managing editor of Crypto for 0:00:08.760 --> 0:00:26.800 Bloomberg News. It's Thursday, February twenty third. Want to hear 0:00:26.840 --> 0:00:31.840 a big number? How about three point eight billion with 0:00:32.120 --> 0:00:35.200 a b yep, that's the amount of crypto that hacker 0:00:35.240 --> 0:00:37.400 has managed to steal last year and it's a new 0:00:37.479 --> 0:00:41.880 record the company behind that number. Cha analysis also found 0:00:41.920 --> 0:00:45.640 that one specific hacking group was responsible for a huge 0:00:45.720 --> 0:00:48.839 chunk of that stolen crypto. If you guessed that the 0:00:48.840 --> 0:00:51.199 hacking group was Lazarus and you know that they're connected 0:00:51.200 --> 0:00:54.240 to North Korea, congratulations, you're probably a regular listener of 0:00:54.280 --> 0:00:59.000 this podcast. Lazarus allegedly stole one point seven billion dollars 0:00:59.000 --> 0:01:02.400 in twenty twenty two, with compares with less than half 0:01:02.440 --> 0:01:06.160 a billion dollars the year before. This further solidifies the 0:01:06.200 --> 0:01:10.400 notion that North Korean hackers are seeing the cryptocurrency sector 0:01:10.480 --> 0:01:13.440 as a way to raise funds and revenue in the 0:01:13.440 --> 0:01:17.240 face of international sanctions. Now, what does all of this 0:01:17.360 --> 0:01:19.360 mean for the crypto markets and what does it mean 0:01:19.400 --> 0:01:22.360 for you? If you hold crypto? Can anything to be 0:01:22.360 --> 0:01:25.199 done to prevent these kinds of hacks from happening. Joining 0:01:25.240 --> 0:01:38.240 me now is Bloomberg REPORTO Jeff Stone with more. Jeff, 0:01:38.280 --> 0:01:40.200 welcome back to the podcast. Thank you for having me. 0:01:40.560 --> 0:01:42.360 We are once again I'm going to talk about hackers. 0:01:42.800 --> 0:01:44.280 I love it. That's what I'm here for. Happy to 0:01:44.319 --> 0:01:47.760 do it. I continue to be fascinated by the fact 0:01:48.200 --> 0:01:53.680 that the North Koreans in particular seem to have emerged 0:01:54.320 --> 0:02:00.400 as the most profitable hackers in the entire old. Is 0:02:00.440 --> 0:02:04.640 that a fair assessment, I think so. It's a difficult 0:02:04.640 --> 0:02:09.440 thing to quantify candidly, but in very broad terms. If 0:02:09.480 --> 0:02:15.000 you think about the big nation state hacking groups, North 0:02:15.080 --> 0:02:19.720 Korea is singularly focused on generating revenue for Pyongyang. We 0:02:19.800 --> 0:02:24.799 know that they're under intense international sanctions, so raising money 0:02:24.880 --> 0:02:28.919 via hacking is a key part of their existence. Really, 0:02:29.120 --> 0:02:32.240 whereas like a Chinese hacking group might be more focused 0:02:32.280 --> 0:02:35.280 on stealing intellectual property, for instance. We know that Russia 0:02:35.320 --> 0:02:37.359 has been involved in all kinds of political stuff as 0:02:37.400 --> 0:02:40.280 well as just different kinds of mayhem, but that's really 0:02:40.600 --> 0:02:44.280 North Korea and hacker's singular focus. You know, you recently 0:02:44.320 --> 0:02:49.119 published a story about the fact that crypto hacks in general, right, 0:02:49.240 --> 0:02:52.080 so anything that you could mention, and this is based 0:02:52.120 --> 0:02:55.800 on a report by ch Analysis, had reached nearly four 0:02:55.840 --> 0:02:59.640 billion dollars in twenty twenty two, which was an increase 0:02:59.639 --> 0:03:01.440 from the year before when it was about three point 0:03:01.440 --> 0:03:04.040 three billion dollars. But the thing again that blew me 0:03:04.080 --> 0:03:07.440 away was how much of that was directly attributable to 0:03:07.480 --> 0:03:11.079 this one particular North Korean group. Me too, I mean, 0:03:11.080 --> 0:03:13.720 that was the biggest surprise, you know. I think everyone, 0:03:13.760 --> 0:03:15.760 probably all your listeners spent a lot of last year 0:03:15.800 --> 0:03:19.920 reading about different hacks and major hundreds of millions of 0:03:19.919 --> 0:03:24.160 dollars worth of theft in cryptocurrency. It's pretty staggering to 0:03:24.600 --> 0:03:27.839 think about almost half of that, half of that three 0:03:27.840 --> 0:03:30.920 point eight billion being the work of North Koreans and 0:03:30.919 --> 0:03:33.480 then the rest being various other parties. I think a 0:03:33.520 --> 0:03:36.200 lot of those are still under investigation, but this relatively 0:03:36.280 --> 0:03:41.960 small apparently military intelligence hacking units has taken the vast 0:03:42.040 --> 0:03:44.640 majority of the sum of virtual currency last year. It 0:03:44.720 --> 0:03:47.520 seems like they really sharpened their focus on crypto because 0:03:47.520 --> 0:03:51.160 the year before, hacks attributed to Lazarus, which is what 0:03:51.160 --> 0:03:54.000 they're called, were like less than five hundred million dollars, right, 0:03:54.560 --> 0:03:57.800 that's a pretty dramatic increase. Like what's driving that, It's 0:03:57.840 --> 0:04:02.000 difficult to know from sitting outside Telligence Agency. It seems 0:04:02.000 --> 0:04:03.880 like they were successful and they found a way to 0:04:03.920 --> 0:04:05.360 do it, and they're going to continue to do it. 0:04:05.760 --> 0:04:09.640 If you think back to previous generations, we know that 0:04:09.840 --> 0:04:13.880 North Koreans were accused of counterfeiting cash, you know, American 0:04:14.160 --> 0:04:16.920 US dollars and using that in the black market to 0:04:17.000 --> 0:04:19.040 raise money. We know that they have a history of 0:04:19.120 --> 0:04:22.120 using counterfeit cigarettes and kind of propping up a lot 0:04:22.120 --> 0:04:25.560 of that trade over the past couple decades. Cryptocurrency seems 0:04:25.600 --> 0:04:30.679 to be their next mL And is that because people 0:04:30.720 --> 0:04:33.839 in crypto are like uniquely prone to being bamboozled? Is 0:04:33.880 --> 0:04:36.760 it because the crypto company security isn't great? Is it 0:04:36.839 --> 0:04:39.159 kind of a culmination of things. I think there's a 0:04:39.240 --> 0:04:42.520 scramble to get rich in crypto. Certainly over the past 0:04:42.560 --> 0:04:45.719 couple of years. I think that has led to a 0:04:45.839 --> 0:04:49.920 reduction in the amount of perhaps scrutiny that people are 0:04:49.920 --> 0:04:53.880 putting on different projects and really rushing to kind of 0:04:53.920 --> 0:04:56.800 monetize in this space. There's a new currency we have 0:04:56.839 --> 0:04:59.120 to jump on this, there's a new market. We have 0:04:59.160 --> 0:05:01.000 to jump on this. There's lot of speculation, as you 0:05:01.040 --> 0:05:04.480 know better than anyone, and North Korea is honing their 0:05:04.480 --> 0:05:08.280 craft at really inserting themselves into that process. Well, so 0:05:08.440 --> 0:05:10.520 that point, you know, I think a lot of folks 0:05:10.880 --> 0:05:14.320 have this very stereotypical idea that all hacking is just 0:05:14.400 --> 0:05:17.839 like someone probably a dude, hovering in front of a 0:05:17.880 --> 0:05:21.560 computer in which like green text on a black background 0:05:21.720 --> 0:05:24.679 is flashing before their very eyes. But you've also reported 0:05:24.720 --> 0:05:28.239 on the ones that like there are folks doing fake 0:05:28.320 --> 0:05:32.480 interviews to try to get intelligence at crypto companies, say 0:05:32.520 --> 0:05:35.680 more about some of these strategies. Yeah, that kind of 0:05:35.680 --> 0:05:39.640 hacker in abasement stereotype is no longer the case. There 0:05:39.640 --> 0:05:43.440 have been US indictments against alleged North Kreen hackers, while 0:05:43.480 --> 0:05:46.160 one came out in twenty twenty one that was really 0:05:46.600 --> 0:05:51.119 revelatory in some of the scope of these efforts. These 0:05:51.240 --> 0:05:56.880 are professional soldiers who spend their lives going to international 0:05:56.880 --> 0:06:01.560 competitions abroad. They are working very carefully night and day 0:06:01.600 --> 0:06:04.520 to get as good as they can at using Western 0:06:04.640 --> 0:06:07.480 languages online. They're very good at programming. It's the same 0:06:07.560 --> 0:06:10.719 kind of programming that you would learn at Stanford or 0:06:10.760 --> 0:06:14.400 Harvard in a kind of coding program. And the reason 0:06:14.440 --> 0:06:16.560 that they're so motivated and the reason that they're so 0:06:16.839 --> 0:06:20.120 crafty is because a lot of their life depends on it. 0:06:20.839 --> 0:06:24.400 They are supporting families, you know, according to an analysis 0:06:24.400 --> 0:06:26.760 of these some of these charges that have come out 0:06:26.800 --> 0:06:30.599 against these alleged hackers, but they're really prolific and they're 0:06:30.640 --> 0:06:33.320 incredibly focused. I had a researcher tell me one of 0:06:33.360 --> 0:06:37.120 the reasons they're so good at using fake resumes, for instance, 0:06:37.240 --> 0:06:41.640 or searching on LinkedIn or indeed for job data they 0:06:41.640 --> 0:06:45.920 can kind of use for themselves is because they need 0:06:45.960 --> 0:06:49.720 to do it. There's not a lot of other options 0:06:49.760 --> 0:06:53.039 that they have to raise revenue online. You know. One 0:06:53.080 --> 0:06:56.440 person mentioned to me that they are doing a lot 0:06:56.480 --> 0:06:58.960 more with a lot less than other hacking groups have 0:06:59.080 --> 0:07:02.679 in terms of technology. Coming up more from Bloomberger posts 0:07:02.800 --> 0:07:14.520 Jeffstone on record breaking cryptoffs. We'll be right back. One 0:07:14.520 --> 0:07:17.000 of the other things that I find interesting about what 0:07:17.040 --> 0:07:19.960 you're describing in terms of like these motivations, you know, 0:07:20.000 --> 0:07:22.200 these are folks with families, These are folks who are 0:07:22.480 --> 0:07:26.880 who are trying to survive. It also seems to me 0:07:27.120 --> 0:07:30.680 that it doesn't seem to be slowing down at all, 0:07:30.720 --> 0:07:33.560 you know, like the numbers are getting bigger every single time, 0:07:33.640 --> 0:07:36.640 like year over year these reports are coming out. Is 0:07:36.640 --> 0:07:39.600 there any way to stop any of this? There's not 0:07:39.600 --> 0:07:41.920 an obvious way to stop it. We know the Department 0:07:41.920 --> 0:07:47.360 of Treasury is engaged in kind of an information tour 0:07:47.520 --> 0:07:50.800 to ensure that organizations, particularly in the cryptocurrency world and 0:07:50.800 --> 0:07:54.160 the financial world and the technology sector, have a stronger 0:07:54.240 --> 0:07:57.880 understanding of what's happening. A lot of your listeners will 0:07:57.880 --> 0:08:01.480 be familiar with the sanctions against Tornado Cash and Blender, 0:08:01.520 --> 0:08:05.320 which are some of these mixing services that these actors 0:08:05.320 --> 0:08:09.960 have used to launder cryptocurrency. We know, according to recent 0:08:10.000 --> 0:08:15.239 reports from just recently, there is a new service called 0:08:15.280 --> 0:08:20.000 Sinbad that has allegedly used to you know, convert a 0:08:20.040 --> 0:08:22.120 lot of these transactions in a way that is more 0:08:22.160 --> 0:08:26.680 difficult for law enforcement and for independent security researchers to track. 0:08:27.240 --> 0:08:31.800 So those are all really subtle but important indications that 0:08:32.280 --> 0:08:36.800 this phenomenon is going to continue, if not accelerating. You know. 0:08:36.840 --> 0:08:40.240 One of the things that people I remember, I grew 0:08:40.320 --> 0:08:41.720 up in the ins and as am of the generation 0:08:41.760 --> 0:08:43.960 that was like, you know, forget hotmail I had I 0:08:43.960 --> 0:08:47.800 had accounts before hotmail existed. It would be like, don't 0:08:47.840 --> 0:08:51.000 click any links, don't give anybody your credit card details. 0:08:51.920 --> 0:08:55.840 How do you defend against someone who is pretending to 0:08:56.040 --> 0:08:59.640 be not a North Korean hacker in a job interview, 0:08:59.840 --> 0:09:03.200 or who is engaging in some of the more sophisticated 0:09:03.240 --> 0:09:06.240 techniques like cloning your simcard? Like is there anything a 0:09:06.280 --> 0:09:09.840 person can do if even governments configure this out. The 0:09:09.920 --> 0:09:13.520 short answer is no, Unfortunately for a lot of investors 0:09:13.679 --> 0:09:16.560 and a lot of people who might find themselves even 0:09:16.600 --> 0:09:19.239 as the targets of surveillance. A little bit outside this conversation, 0:09:19.320 --> 0:09:21.680 but if there's a nation state hacking group that is 0:09:22.360 --> 0:09:26.880 specifically targeting a certain individual or perhaps in exchange, they 0:09:26.920 --> 0:09:30.080 have the means and motive and opportunity and probably the 0:09:30.240 --> 0:09:33.480 orders to make that happen. You might log into your 0:09:33.720 --> 0:09:37.599 personal cryptocurrency website and it looks completely legitimate, just like 0:09:38.160 --> 0:09:40.800 it did yesterday, asks you to insert your user name 0:09:40.800 --> 0:09:44.319 and password, and you do that, and then you find out, 0:09:44.520 --> 0:09:47.320 once your cryptocurrency is gone, that that was a fake 0:09:47.400 --> 0:09:52.120 page that was the product of eighteen months of reconnaissance 0:09:52.280 --> 0:09:57.120 and intelligence gathering and a really careful attack designed to 0:09:57.720 --> 0:10:01.400 take over as much as they possibly can. I mean, 0:10:01.480 --> 0:10:03.480 hearing things like that is one of the reasons folks 0:10:03.520 --> 0:10:06.920 are like everybody should have a cold wallet and you know, 0:10:07.000 --> 0:10:09.400 only access your crypto and computers that are not connected 0:10:09.440 --> 0:10:13.439 to the Internet. That has never felt like a scalable 0:10:13.520 --> 0:10:17.440 solution for the cryptocurrency world. I mean that advice that 0:10:17.440 --> 0:10:20.440 you're describing sounds to me like the cryptocurrency world is 0:10:20.640 --> 0:10:24.560 experiencing some of the pain that the rest of the 0:10:24.600 --> 0:10:27.520 Internet has gone through. When it comes to changing your 0:10:27.520 --> 0:10:31.280 passwords frequently and making sure that you're not reusing the 0:10:31.360 --> 0:10:34.720 same user name credentials across the Internet. It's a very 0:10:34.720 --> 0:10:37.160 difficult problem to solve, so a lot of organizations are 0:10:37.559 --> 0:10:41.280 not offloading that risk onto users but kind of saying, 0:10:41.520 --> 0:10:43.440 you know, those are subtle ways of saying, we can't 0:10:43.440 --> 0:10:45.559 completely protect you. Here's a couple things that you might 0:10:45.559 --> 0:10:48.920 be able to do, but again, it's just very difficult. 0:10:48.920 --> 0:10:51.000 Everyone has busy lives. You can't change your password and 0:10:51.040 --> 0:10:53.360 write it down every day. You have to be able 0:10:53.400 --> 0:10:56.840 to trust systems at a certain point in kind of 0:10:56.880 --> 0:11:00.320 hope that you're not taken for all your worth. You know, 0:11:00.360 --> 0:11:02.640 it's so interesting that so many of these conversations come 0:11:02.640 --> 0:11:04.319 back to trust, because one of the problems of crypto 0:11:04.400 --> 0:11:06.920 was supposed to solve is not having to trust anything 0:11:07.160 --> 0:11:09.559 or anybody, And here we are again talking about having 0:11:09.559 --> 0:11:13.440 to trust systems, just as a kind of a closing question, 0:11:13.679 --> 0:11:16.520 as somebody who has covered cybersecurity for a long time 0:11:16.920 --> 0:11:19.760 and is now kind of a crypto reports as a 0:11:19.800 --> 0:11:22.360 result of that. I really like the analogy that you 0:11:22.480 --> 0:11:24.679 made of you know, this is a problem that's been 0:11:24.679 --> 0:11:27.040 experienced in any other domain that is connected to a 0:11:27.080 --> 0:11:30.360 computer or a silver anywhere in the world. Are there 0:11:30.360 --> 0:11:35.240 things that other domains have done that have helped at all? 0:11:35.360 --> 0:11:39.400 Or is it really just like an intellectual arms race 0:11:40.120 --> 0:11:42.960 over who's going to be more sophisticated, you know, like 0:11:43.040 --> 0:11:45.840 Red team Blue team kind of stuff. The smartest thing 0:11:45.840 --> 0:11:49.520 that you can do is use multi factor authentication. You know, 0:11:49.559 --> 0:11:53.200 from an individual standpoint, it's not going to solve every problem, 0:11:53.200 --> 0:11:55.480 but from an individual standpoint, you want to make sure 0:11:55.480 --> 0:11:58.040 that when you're logging into a website with your password, 0:11:58.800 --> 0:12:02.960 that website verifies you that you are who you say 0:12:02.960 --> 0:12:05.360 you are in a different way, whether that be through 0:12:05.360 --> 0:12:09.560 a text message, which is not the most reliable example anymore, 0:12:10.080 --> 0:12:14.120 or a phone call or a QR code. Make sure 0:12:14.160 --> 0:12:18.560 that that is on all of your accounts, and try 0:12:18.600 --> 0:12:22.920 to be mindful about how far and wide the services 0:12:22.960 --> 0:12:25.760 that you're signing up to are. That's to say, don't 0:12:25.800 --> 0:12:27.880 sign up to every other thing. Try to keep things 0:12:27.880 --> 0:12:30.959 relatively concentrated under your control so that it's not a 0:12:31.040 --> 0:12:34.040 huge shock when in two years a website that you 0:12:34.080 --> 0:12:38.120 completely forgot about is breached in your information spills out. Yeah, 0:12:38.160 --> 0:12:40.040 I mean a couple of weeks ago, I got an 0:12:40.040 --> 0:12:44.080 email from a stationary websites like they literally print cards 0:12:44.080 --> 0:12:46.920 and envelopes, and they're like, so sorry, your information has 0:12:46.920 --> 0:12:48.920 been revealed for the entire incident. I was like, are 0:12:48.920 --> 0:12:50.960 you kidding me? Let me ask you this. When you 0:12:51.040 --> 0:12:53.959 read that, were you like, were you just like of course, 0:12:54.200 --> 0:12:56.199 or were you like, you're not even shocked anymore? Right, 0:12:56.240 --> 0:12:58.160 I'm not even shocked anymore. I mean I think after 0:12:58.280 --> 0:13:01.200 like the big Experience debacle in the United States, which 0:13:01.360 --> 0:13:04.720 you know is that that is a company with literally 0:13:04.760 --> 0:13:09.479 one job right, just identity prosection and they were like oopsie. 0:13:10.480 --> 0:13:14.000 So it can feel really demoralizing that It's like, you 0:13:14.040 --> 0:13:16.640 know you, you're screaming into the void of I'm trying 0:13:16.679 --> 0:13:20.200 so hard and yet I wish I had better news. Sorry. 0:13:20.920 --> 0:13:22.480 You know, so much of being a reporter is like, 0:13:22.520 --> 0:13:26.320 let me tell you how bad it is. So sorry, Yeah, 0:13:26.600 --> 0:13:29.800 especially lately. Well, Jeff on that cherry note, thank you 0:13:29.840 --> 0:13:32.520 as always for coming on the show. Thank you such 0:13:32.600 --> 0:13:36.120 a fan. That was Bloomberg Report to Jeff Stone. You 0:13:36.160 --> 0:13:38.320 can find more of his reporting on the Bloomberg Terminal 0:13:38.360 --> 0:13:40.760 and on Bloomberg dot com. And don't forget to sign 0:13:40.880 --> 0:13:49.640 up for twice weekly newsletter, Bloomberg Crypto. This is Bloomberg Crypto, 0:13:49.840 --> 0:13:53.720 a daily podcast from Bloomberg and iHeartRadio. For more shows 0:13:53.760 --> 0:13:57.920 from iHeartRadio, visit the iHeartRadio app, Apple Podcasts, or wherever 0:13:57.960 --> 0:14:01.480 you get your podcasts. Send us your comments, questions, or 0:14:01.520 --> 0:14:04.560 suggestions for the show to Crypto at Bloomberg dot net. 0:14:07.720 --> 0:14:11.480 The supervising producer of Bloomberg Crypto is Vicky Vergelina. Our 0:14:11.480 --> 0:14:15.320 senior producer is Janet Babin. Our producers are Mohammed Farouk 0:14:15.400 --> 0:14:18.760 and Sharon Barrero. Our associate producers are Ty Butler and 0:14:18.840 --> 0:14:23.120 Moses on m Desta wonder At is our engineer. Original 0:14:23.200 --> 0:14:27.800 music by Leo Sidron. I'm Stacy Marie Schml. We'll be 0:14:27.840 --> 0:14:28.440 back tomorrow.