Speaker 1: I'm Stacy Marie Ishmael, Managing editor of Crypto for Bloomberg News,
Speaker 1: and this is Bloomberg Crypto at Daily Bloomberg. I heart podcast.
Speaker 1: It's Monday June. Have you heard the one about the
Speaker 1: crypto investor who got hacked and lost all their bitcoin?
Speaker 1: It's true. Cryptocurrency spam, hacks, and fraud are all on
Speaker 1: the rise. That means there's an urgent need to think
Speaker 1: about the security risks to these often valuable digital investments.
Speaker 1: Today I speak with Bloomberg reportsa Hannah Miller about the
Speaker 1: nature and scope of these hacks, and I talked to
Speaker 1: a Wrong Way Google, a professor, and a CEO of
Speaker 1: a security firm about how to avoid them. Hannah, Hi,
Speaker 1: thank you so much for joining us today. Thank you.
Speaker 1: I am really really glad you're able to come on
Speaker 1: the show because you have been covering well. In addition
Speaker 1: to covering everything that you're covering, one of your recent
Speaker 1: stories was all about how social media hacks are particularly
Speaker 1: affecting people who have invested in crypto or who are
Speaker 1: thinking about investing in crypto. People may have heard about
Speaker 1: folks losing their board apes because they clicked on a
Speaker 1: SPAMMI link on Instagram. Can you just talk a little
Speaker 1: bit about what it is going on out in this
Speaker 1: wild West world? Yeah, I know, there's obviously a lot
Speaker 1: going on. I think crypto has really been entangled with
Speaker 1: scams for a very long time, and we've really seen
Speaker 1: an upswing recently in people using social media as a
Speaker 1: tool to rip off crypto investors. And a lot of
Speaker 1: that comes down to, you know, people posting malicious links
Speaker 1: click here and all your wildest dreams will come true,
Speaker 1: spam bots spreading those links, and you know, people really
Speaker 1: not being aware of the risks that they're taking when
Speaker 1: and you know they're on social media looking at crypto projects,
Speaker 1: you know, interacting with different accounts. So it's a it's
Speaker 1: a pretty interesting phenomenon and something that the industry really
Speaker 1: has has been grappling with. What does that experience look like? I, um,
Speaker 1: you know a person on Twitter, on on Instagram, on Facebook,
Speaker 1: I see somebody being like, hey, click here to get
Speaker 1: a free board ape. I think that sounds amazing given
Speaker 1: them board apes are selling for hundreds of thousands of dollars.
Speaker 1: What are the mechanics of how these scams work? Yeah,
Speaker 1: a lot of it comes down to mimicry. So you
Speaker 1: might be interacting with an account that looks like it
Speaker 1: comes from an official source. You know, maybe they have
Speaker 1: a handle that's really similar to you know, the name
Speaker 1: of an actual company, or they seem to have, you know,
Speaker 1: tweets that show legitimate activity in the space, and clicking
Speaker 1: on that link might lead you to a website that
Speaker 1: even looks like the official website for an n f
Speaker 1: T collection or startup, and you know, you're asked to
Speaker 1: link your wallet, and that just opens you up to
Speaker 1: you know, having n f T stolen from you, which
Speaker 1: was the case with the you know, board eight pack
Speaker 1: that we saw recently. So I'm a person who you know,
Speaker 1: I click on this link, I don't realize that it's
Speaker 1: it's not official. I hand over my credentials, and then
Speaker 1: some nefarious person on the other end it's like, great,
Speaker 1: we now own all of your stuff. Yeah, pretty much.
Speaker 1: I mean you it can happen very quickly. And again,
Speaker 1: you know, people think that they're going into something that's legitimate.
Speaker 1: They think that they're you know, maybe gonna be a
Speaker 1: part of an n f T drop or crypto giveaway,
Speaker 1: and they're excited and they might not pay attention to
Speaker 1: signs that this isn't a legitimate operation. I'm so glad
Speaker 1: that you said. There's two things in there that are
Speaker 1: so important, right then, not paying attention and the being
Speaker 1: excited pot Because you know, when I've when I've studied
Speaker 1: and reported on misinformation and disinformation and why people fall
Speaker 1: for things online, it's often because you're in an emotion
Speaker 1: chanel state that makes you particularly susceptible to making a
Speaker 1: bad decision. And in this case, it sounds like you know,
Speaker 1: these these these scammers, these hackers, they're preying on that
Speaker 1: not wanting to miss out on a deal instinct, or
Speaker 1: just the thrill of being invited to participate to something
Speaker 1: up your life that are insane. Yeah, that's exactly what's
Speaker 1: happening here. Um. People get excited, they you know, jump
Speaker 1: on board. And in some cases too, it's the actual
Speaker 1: account belonging to the startup or the n f T
Speaker 1: collection um, which adds another layer of deception. WHOA, Okay,
Speaker 1: so I might actually be looking at a legitimate Twitter
Speaker 1: accounts or Instagram, but they have been hacked. And then
Speaker 1: so when I click on those links, even though I
Speaker 1: think I'm doing the right thing because I check to
Speaker 1: see that Hell, okay, this is the verified account. This
Speaker 1: looks legit. Turns out it wasn't legit after all. Yes,
Speaker 1: that's a exactly what happened with the Board eight hack.
Speaker 1: It was their official Instagram account that was compromised. We
Speaker 1: don't really know the details of how that happened. A
Speaker 1: lot of people think it's because of social engineering that,
Speaker 1: you know, some an account holder for the board apiacht
Speaker 1: Club Instagram handle was somehow manipulated into you know, giving
Speaker 1: access um. But yeah, this was the official board apiacht
Speaker 1: Club account and it linked to a website modeled off
Speaker 1: of the board apiacht Club website. So really there was
Speaker 1: just uh an extra level of trickery here. So a high,
Speaker 1: high level of sophistication is what we're dealing with, correct,
Speaker 1: Given that, it seems to me a little bit unfair
Speaker 1: for folks to be like, well, you should just pay
Speaker 1: more attention to the incidents and not click on any links.
Speaker 1: I like, if people are trying to do the right
Speaker 1: thing and they're still getting scammed, what are the big
Speaker 1: social media companies doing about this? What are the big
Speaker 1: crypto companies doing about this? Because that does seem to
Speaker 1: be a direction that you know, systemic intervention sounds like
Speaker 1: it's what's needed here. Yeah, I know what the big
Speaker 1: tech companies do have options here encouraging users to do
Speaker 1: things like two factor authentication to secure their accounts, you know,
Speaker 1: requiring them to have it secured both via email and
Speaker 1: phone number. That's something that can help increase security. Uh.
Speaker 1: There are also you know, options like using AI to
Speaker 1: clean out spam bots that might be spreading these scammy links, um,
Speaker 1: and these tools for filtering out spam bots. Those also
Speaker 1: come at a cost to the social media company because
Speaker 1: it clear it lowers their user a count, which isn't
Speaker 1: a good look. So basically, by reducing spam activity, you
Speaker 1: reduce overall engagement. And there's some some analysts looking at
Speaker 1: metrics and being like why are your numbers down exactly?
Speaker 1: And for a company that's reporting those things and earnings, yeah,
Speaker 1: it's not a good look. Um. Yeah no. And with
Speaker 1: these user accounts, you know, they're also specific policies uh
Speaker 1: that prevent spam accounts being in place. Twitter requires BOD
Speaker 1: accounts to be identified as BOD accounts. Um. They have
Speaker 1: reporting tools that users can you know, put in concerns
Speaker 1: about suspicious activity that they see on the platforms. So
Speaker 1: you know, there there are steps that they can take.
Speaker 1: And as for crypto companies, you know, it's very interesting.
Speaker 1: A lot of these companies are growing very quickly, they're
Speaker 1: very young, UM, and they might be more interested in
Speaker 1: hiring you know, engineers, developers, people who can help them
Speaker 1: build out the product. And where they're cutting corners is cybersecurity.
Speaker 1: And part of what UM you know, recommendation that I've
Speaker 1: heard is that they should actually focus on hiring cybersecurity
Speaker 1: specialists early on, especially those who specialized of blockchain and
Speaker 1: you know, investing in that part of their business and
Speaker 1: that could help prevent scams down the line. UM. They
Speaker 1: can also do things like offer bug bounties, So if
Speaker 1: white hat had er see some sort of vulnerability in
Speaker 1: their code that could be used to scam users, they
Speaker 1: can work with the white hat hacker and actually reward
Speaker 1: them for for finding this flaw and you know, kind
Speaker 1: of advertise that to get more white hat hackers on board.
Speaker 1: And the idea of a white hat hacker hacker these
Speaker 1: are like these are the good ones. These are the
Speaker 1: ones who are not trying to steal money from people.
Speaker 1: They're trying to stop people from having money stolen from
Speaker 1: them exactly. They're using their expertise to find flaws in
Speaker 1: you know, different in the security of different platforms, and
Speaker 1: uh there will alert teams as to you know, what
Speaker 1: they can do to to patch these areas. Other than
Speaker 1: you know, while we wait for the big tech companies
Speaker 1: to put these things in place, and other than people
Speaker 1: just not clicking any links on the internet. Ever, if
Speaker 1: you had one piece of advice for folks who will
Speaker 1: worried about these kinds of scams, what would it be.
Speaker 1: Pay attention, you know, see whether like this is actually
Speaker 1: a legitimate operation. Check the Twitter handle, see if it's verified.
Speaker 1: Really you know a lot of these startups too, like
Speaker 1: they're pretty easy to reach out to, like on Telegram
Speaker 1: or Discord or whatever may like, do your homework essentially
Speaker 1: and try to find out whether this is like a
Speaker 1: legitimate announcement and really just I I don't recommend connecting
Speaker 1: your wallet to anything unless you're a pent sure that
Speaker 1: this is a real thing, a real legitimate operation. Awesome,
Speaker 1: Thank you so much, Hannah. You can find more of
Speaker 1: Hannah's repoising on the Bloomberg terminal. Of course, on Bloomberg
Speaker 1: dot com and on Twitter at h G milla nine.
Speaker 1: We'll be right back. So what can we do about
Speaker 1: these hacks? And how can people protect their digital assets
Speaker 1: in an increasingly decentralized environment. Wrong Waygo is the chief
Speaker 1: executive officer of a blockchain security firm, Cult Curtic and
Speaker 1: an assistant professor at Computer Science at Columbia University. Professor,
Speaker 1: what I'm hearing from you is we're dealing with a
Speaker 1: couple of things at once. We're dealing with more of
Speaker 1: these hacks. We're dealing with more sophistication in terms of
Speaker 1: these hacks, a bigger range of types of people who
Speaker 1: are being targeted, and you you work with different firms
Speaker 1: and companies to help them protect themselves and their users
Speaker 1: from these kinds of exposures. What does that look like
Speaker 1: in practice? You know, webstue and website are quite different.
Speaker 1: Webstry apps are built on top of blockchain, which can
Speaker 1: be viewed as a world computer that no one has stopped.
Speaker 1: So if obser the deployment meant even if people have
Speaker 1: identified militia transactions or code of avulnerabilities in their programs,
Speaker 1: is very hard to make changes or a hatches so
Speaker 1: that's why we have to make sure that the software
Speaker 1: all these applications are as cure as possible before the
Speaker 1: deployment and on the on kind of the individual consumer side.
Speaker 1: And like one of the things that you have alluded
Speaker 1: to a kind of quote to you on this in
Speaker 1: her story is around the idea of falling for what's called,
Speaker 1: you know, social engineering. How do you help people not
Speaker 1: fall for social engineering? So where where you know somebody
Speaker 1: is manipulated into revealing credentials, Yes, it's there. It's a
Speaker 1: good caution. How to I would say, how to protect
Speaker 1: you're accust you're as a form social engineering? One chips
Speaker 1: is as for all these accounts you are vality, the
Speaker 1: costs or their social medium accounts should be associated was
Speaker 1: let's say the phones or email addresses that are not
Speaker 1: publicly available for other people. So that means if somebody
Speaker 1: calls you and that you know, it's suspicious because nobody
Speaker 1: should have it. Got it? Um? What do you think
Speaker 1: the responsibilities are of you know, these decentralized companies that
Speaker 1: are coming up or even the web two ones that
Speaker 1: are playing in crypto in terms of user protection, Yeah,
Speaker 1: they have played their Their responsibility is to making sure
Speaker 1: their system their applications are are as you care as
Speaker 1: as possible. But as I mentioned, website is quite different
Speaker 1: from Websture company. Many have webbed to several defense techniques.
Speaker 1: Just counst be applied directly to this new too. Men,
Speaker 1: due to the challenges that I've mentioned that you can
Speaker 1: add patches right you you call many changes after the deployment,
Speaker 1: so they shouldn't make sure that their their software, our
Speaker 1: secure are free of boom better to before deployments, which
Speaker 1: is not a you know, a practice that will be
Speaker 1: followed by web to company, but they have to situate
Speaker 1: in web streets. Well, thank you very much for joining us, professor,
Speaker 1: who really appreciate you taking the time. Okay, yeah, Man
Speaker 1: of Thane. On the next episode of Bloomberg Crypto, have
Speaker 1: you ever heard the saying everything is bigger in Texas?
Speaker 1: The same applies to mining bitcoin in the state. The
Speaker 1: States of Texas is flush with bitcoin miners, including the
Speaker 1: city of Fort Worth that started a small mining operation
Speaker 1: out of its city hall. Tomorrow I'll talk with Bloomberg
Speaker 1: report to Mike Smith about what makes the states so
Speaker 1: attractive to crypto enthusiasts, and you'll hear from Lee Bratcha
Speaker 1: ahead of the Texas Blockchain Council, who will share more
Speaker 1: about that partnership with the City of Fort Worth. I'm
Speaker 1: Stacy Marie Ishmael, and this is Bloomberg Crypto, a daily
Speaker 1: podcast from Bloomberg and I Heart Radio. For more shows
Speaker 1: from I Heart Radio, visit the I Heart Radio app,
Speaker 1: Apple Podcasts, or wherever you get your podcasts. Email your questions, comments,
Speaker 1: or suggestions to Crypto at bloomberg dot net. Follow us
Speaker 1: on Twitter We're at Crypto. The supervising producer and editor
Speaker 1: of this episode is Vicky Vergalina. Desk to wonder At
Speaker 1: is our engineer. Original music by Leo Sidron. Bloomberg's head
Speaker 1: of podcasts is Francesca Levi.