Speaker 1: I'm Stacy Marie Ishmael, Managing editor of Crypto for Bloomberg News,
Speaker 1: and this is Bloomberg Crypto at Daily Bloomberg. I heard podcast.
Speaker 1: It's Tuesday, August sixteen. In late July, allegations surface that
Speaker 1: some North Koreans were plagiarizing online resumes to try to
Speaker 1: trick companies, including crypto companies, into hiring them. It was
Speaker 1: all part of a broader effort to raise money from
Speaker 1: North Korea's government weapons program and an attempt to help
Speaker 1: the authoritarian nation evade global sanctions. But how did North
Speaker 1: Korea get so good at tricking crypto employers? And what
Speaker 1: does all of this mean for the security of these companies?
Speaker 1: This is geopolitics, and there's a lot of ugliness to this,
Speaker 1: But some of these tactics are really innovative. I mean
Speaker 1: they're very impressive. Bloom of reports to Jeff Stone joins
Speaker 1: me today to explain. Jeff, what a pleasure. Thank you
Speaker 1: so much for being here, Thank you for having me.
Speaker 1: So what is it you do at Bloomberg? I read
Speaker 1: about cybersecurity, which is a busy task. It's a collision
Speaker 1: of crime and espionage and business and money and theft
Speaker 1: it's endlessly fascinating. That sounds fun even writing a lot
Speaker 1: about North Korea and hackers. What are North Korean hackers
Speaker 1: up to in crypto? They are similarly busy in crypto.
Speaker 1: According to the United States, that is, North kreen hackers
Speaker 1: increasingly are focusing on on cryptocurrency services as a means
Speaker 1: of generating money on behalf of the government of Kim
Speaker 1: Jong Un. According to the US government, that is and
Speaker 1: um independent cybersecurity researchers. That means they are looking at
Speaker 1: everything from hacking exchanges. They're also impersonating people. They are
Speaker 1: sending fake jobless things and pretending to be people who
Speaker 1: they aren't in or to get as much information as
Speaker 1: they possibly can about the world of virtual currency. So
Speaker 1: I'm a North Korea hocko. I look up somebody's linked
Speaker 1: in profile. Thought person seems like they have a fancy
Speaker 1: job at a fancy crypto company. I steal some of
Speaker 1: their credentials. I present them as my own. I try
Speaker 1: to interview at name and exchange. In the process of
Speaker 1: that interview. What am I doing. I'm trying to get
Speaker 1: information out of them. It's kind of like, you know, spying,
Speaker 1: or is it something else? You're doing two things. I
Speaker 1: think you're you are trying to get as much information
Speaker 1: as you possibly can from the person that you're speaking with,
Speaker 1: because that just might help you if you don't get
Speaker 1: the job. You also are trying to get the job.
Speaker 1: According to the researchers that we have spoken with, they
Speaker 1: have observed freelance contractors if you will secure employment at
Speaker 1: some of these services. We don't know which services candidly,
Speaker 1: but um, if they are involved in some of these
Speaker 1: bridge projects, for instance, or the future of Ethereum, that
Speaker 1: gives them not only a salary, which according to one
Speaker 1: recent US governmental alert, could be as much as dollars
Speaker 1: crypto Paz, and also it also does bring the espionage angle,
Speaker 1: as you just alluded to, like, yeah, we can kind
Speaker 1: of share this information in our country and use this
Speaker 1: to kind of get around some of these sanctions. Right,
Speaker 1: So I'm not only interviewing because I want to get
Speaker 1: stuff out of my interview. I'm interviewing because, as you say,
Speaker 1: I'm actually trying to work there and find even more
Speaker 1: stuff outs. Right, And if you don't get the job
Speaker 1: or if you get fired, it's probably not the end
Speaker 1: of the world, because you're you're you're already employed. Yeah, right,
Speaker 1: wild Now. So North Korea, when did they first start
Speaker 1: realizing the kind of crypto could be a meaningful revenue
Speaker 1: generator for them. It's difficult to peg that to a
Speaker 1: specific date, but some of the conversations that we've had
Speaker 1: indicate this would have happened probably four or five six
Speaker 1: years ago. You might remember the Bangladesh Bank heist um
Speaker 1: there was a number of financial, big financial hacks. They
Speaker 1: tried to steal a billion dollars from the Bangladesh Bank
Speaker 1: um central Bank via the Swift network. Bangladesh, the central bank,
Speaker 1: which is pretty vulnerable to a cyber attack, has been attacked.
Speaker 1: It is a murky story, and it's a murky story
Speaker 1: about vulnerability, and it's about cyber Two sort of transactions.
Speaker 1: The first one was about eighty one million U S dollars.
Speaker 1: There was another attempted transaction nearly a billion dollars. People
Speaker 1: look at this and I think this is very, very shady. Indeed,
Speaker 1: that was kind of a big watershed moment in the
Speaker 1: world of financial security. A lot of banks started to
Speaker 1: kind of improve the way that they were verifying that
Speaker 1: users are who they say they are, so right around
Speaker 1: that time is when cryptocurrency started to become more real.
Speaker 1: Last year, we know according to analysis, for instance, UM,
Speaker 1: some of these North Korean hackers were involved in like
Speaker 1: seven hacks. We've already seen that, you know, significantly more
Speaker 1: and raising more money in the first half, so you know,
Speaker 1: you say, there there is even more money in this year,
Speaker 1: Like what are the sums that we're talking about? According
Speaker 1: to public charges, at least the Lazarus Group, which is
Speaker 1: North Korea's state sponsored hacking organization, took as much as
Speaker 1: six hundred million dollars in the hack on Xi Infinity
Speaker 1: and March. That's already significantly more than they are accused
Speaker 1: of stealing last year, which was four hundred million dollars UM,
Speaker 1: and there have only been more incidents since then. The
Speaker 1: blockchain company Harmony said in June attacker stole an additional
Speaker 1: hundred million dollars and um, there's Nomad breach, which is
Speaker 1: still an investigation, but attackers stole a million from bridge
Speaker 1: protocol tool there. So again it's hard to pin it
Speaker 1: down to its specific figure, but it's it's significantly we've
Speaker 1: seen that's that's a lot of money, and all of
Speaker 1: those are hacks that are big enough for you know,
Speaker 1: us to cover them here at Bloomberg. So there's certainly
Speaker 1: things that we're paying attention to. Well, what I'm getting
Speaker 1: from you is it sounds like the North Korean hackers
Speaker 1: are good at their jobs. Sure, let's talk about the
Speaker 1: people who seem to need to be better at their jobs. Like,
Speaker 1: I'm a recruiter. Why am I getting spoofed by somebody
Speaker 1: with a fake resume? Like? What's going on? It's hard
Speaker 1: to find people? Just you know, this is not a
Speaker 1: problem that's limited to crypto. We know this is happening
Speaker 1: in other industries, the technology industry, software development, but crypto
Speaker 1: specifically is really being targeted. I think that it's also
Speaker 1: as they are trying to find the right people. Um,
Speaker 1: you do have to take steps to be more flexible
Speaker 1: in terms of allowing remote work for instance. Or I
Speaker 1: was gonna say, like, are these folks flying from North
Speaker 1: Korea to the US. Not that we're aware of, but
Speaker 1: you know, there is a small number of people who
Speaker 1: have these skills, as you know, and um, as they
Speaker 1: as they try to find the right people, you kind
Speaker 1: of need to make certain allowances. Maybe someone doesn't sound
Speaker 1: quite right on the phone, but Hey, they have this
Speaker 1: this skill and they're willing to take this salary for
Speaker 1: um X number of dollars, so we can't find anybody
Speaker 1: else to do it. So Okay, I'm a recruiter. I'm stressed,
Speaker 1: I'm busy. I have some CEO being like hire more people.
Speaker 1: I'm hiring more people. Fine, humans make mistakes. But the
Speaker 1: thing that seems bigger to me is the fact that
Speaker 1: these as you describe them, crypto bridges, which you can
Speaker 1: think of as like protocols that let you move crypto
Speaker 1: from one thing to another thing, and you know, a
Speaker 1: highly simplified version of what's going on, these things get
Speaker 1: hacked a lot for a lot of money, fairly frequently.
Speaker 1: And that's before you get to the other like completely
Speaker 1: run of the mill scams like fishing or spoofing. As
Speaker 1: an as an industry, is crypto getting better at its
Speaker 1: security practices, From like your perspective of someone who's covered
Speaker 1: this more broadly, from my perspective, it is not. Candidly.
Speaker 1: We talked about the Bangladesh bank hast a few years ago,
Speaker 1: there was a number of big financial hacks. I would
Speaker 1: expect personally this first six months of this year to
Speaker 1: really be kind of you know, no industry can stand
Speaker 1: to lose x number billion dollars a year. It's it's embarrassing.
Speaker 1: It creates you know, there's the issues that have to
Speaker 1: do with trust, which obviously so much of um the
Speaker 1: root of this industry. So to lose so much money
Speaker 1: so quickly, we know that real people are are really
Speaker 1: losing significant amount of cash. And we're we're hearing candidly
Speaker 1: from people who are trying to get more into crypto
Speaker 1: and see it as a investment opportunity and something cool
Speaker 1: and new and interesting to think about. And it's hard
Speaker 1: to know the difference between scams and real services because
Speaker 1: the names and you know, it's it's just really scary
Speaker 1: to hear about these massive dollar figures. Yeah, and this
Speaker 1: is this is an industry that loves to say, you know,
Speaker 1: do your own research, but it sounds like even the
Speaker 1: people who are doing their research are still getting into trouble.
Speaker 1: Is there is there kind of a degree of sophistication
Speaker 1: that's being deployed against these companies or is it you know,
Speaker 1: much more run of the mill. It is it is
Speaker 1: as run of the mill as a typical email scam
Speaker 1: that you might have seen against a bank um a
Speaker 1: few years ago. We previously have have written about some
Speaker 1: instances where these crypto scammers were hijacked Twitter accounts for instance.
Speaker 1: Those Twitter accounts will be off to be verified. They
Speaker 1: belong to real people and often like heads of state,
Speaker 1: you know, very specific people on the internet. Yet great example,
Speaker 1: they are soliciting donations. They are raising a ton of
Speaker 1: money in a very short amount of time, even before
Speaker 1: those crypto scams are removed from Twitter. So you know,
Speaker 1: I think there's some board a activity earlier this year
Speaker 1: that was fraudulent, or yeah, the board of Instagram got
Speaker 1: hacked because of you know, probably like social engineering. Somebody
Speaker 1: clicked on a link they shouldn't have clicked on. Social
Speaker 1: engineering is not complicated stuff. It's it's sending a fake
Speaker 1: text message that looks real that tricks the wrong person
Speaker 1: into providing their user name password. You only need to
Speaker 1: do it successfully once in order to make a lot
Speaker 1: of money. So you know, as an example of that,
Speaker 1: I get constant text messages like pretending to be this
Speaker 1: is chased and you need to change your password, and
Speaker 1: here's this really skeptical looking link that you should click
Speaker 1: on and give us all your information. But it can
Speaker 1: also be you know, somebody calling someone up and saying, hey,
Speaker 1: I work here and I've locked myself out of my password?
Speaker 1: Can you help me reset it? That seems to happen.
Speaker 1: We've also you all have also been reporting on things
Speaker 1: sim swapping, which sounds fun like, what does that mean? Exactly? Well,
Speaker 1: sim swopping is endlessly fascinating. Similarly broadly defined um it
Speaker 1: involves you losing control of your phone number. So if
Speaker 1: you have your forgot passwords set up so that if
Speaker 1: you can't remember your credentials, it will send a text.
Speaker 1: It will send a text to your phone. If someone
Speaker 1: identifies you as a particularly valuable target, they will call
Speaker 1: the phone company. There have been public charges, for instance,
Speaker 1: of crypto scammers or sim swappers, I should say bribing
Speaker 1: customer service employees at cell providers. A T T had
Speaker 1: a major problem with this a few years ago. There
Speaker 1: have been a number of indictments against former A T
Speaker 1: T employees. They're not paid a lot of money when
Speaker 1: they're working in a retail store. It is as simple
Speaker 1: as bribing a retail employee to m make this change
Speaker 1: to someone's phone account. You take over their number. You
Speaker 1: then have access to their best words. So anybody who's
Speaker 1: texting me, whether that is you know, my Gmail rees
Speaker 1: set or like my friends in the group text, that's
Speaker 1: all going to somebody else's phone. It's that's correct. You
Speaker 1: can access your phone at all, you can't access any
Speaker 1: of your apps or your accounts. I should say that's
Speaker 1: not a problem with crypto necessarily, it's a problem with
Speaker 1: the way that users are authenticated typically in the United States,
Speaker 1: is not a problem as much elsewhere, but the way
Speaker 1: that our phone numbers have become social security I was
Speaker 1: going to say the same thing, they are super important,
Speaker 1: and that that is a real vulnerability that people are
Speaker 1: learning to exploit and make a lot of money rapidly.
Speaker 1: We'll be right back with more from Bloomboog Reports at
Speaker 1: Jeffstone on the threat of North Korea and crypto. Is
Speaker 1: there anything that has proven effective against these crypto hackos
Speaker 1: and scammas, especially the North Korean groups. The problem with
Speaker 1: trying to stop some of these attacks in these campaigns
Speaker 1: is they are developing as quickly as this technology. Some
Speaker 1: of the kind stations that we had recently with folks
Speaker 1: from mandy It, for instance, indicated that no longer are
Speaker 1: these hackers just targeting end users. They're no longer just
Speaker 1: targeting the exchanges. They are now trying to get jobs
Speaker 1: with these bridge services, for instance, and get an edge
Speaker 1: into um some of the changes to Ethereum that might
Speaker 1: be coming up. So I don't think there is any
Speaker 1: silver bullet to solving these issues. It's just a matter
Speaker 1: of constant diligence and really I think adopting the mentality
Speaker 1: that you are vulnerable and people are trying to get
Speaker 1: in there in ways that maybe you didn't expect. I
Speaker 1: know that's not super helpful, but it's what we're seeing. Well.
Speaker 1: Certainly one of the other things that we're starting to
Speaker 1: see is that the US government is really cracking down,
Speaker 1: you know the recently the U. S. Treasury Department issued
Speaker 1: sanctions on something called a crypto mixer. And if if
Speaker 1: you think about what a crypto mixer is, it's a egine.
Speaker 1: You have, you know, some bitcoins, some Ethereum, some she
Speaker 1: but you knew some doge and you want to, shall
Speaker 1: we say, obscure the origin of those various bits of
Speaker 1: currency and where you got them from. You would put
Speaker 1: them into a mixer, which effectively like anonymizes those transactions
Speaker 1: and spits out something that's a little bit harder to trace.
Speaker 1: You can imagine that services like that might be very
Speaker 1: attractive to say, North Korean hackers, And so what what
Speaker 1: what is the U. S Treasury Department been trying to
Speaker 1: do with these services? They're trying to stop North Korean
Speaker 1: hackers from using them in whatever way they that they can.
Speaker 1: What's particularly interesting about this is the way that these
Speaker 1: mixing services have become kind of an extension not in
Speaker 1: every case, in some cases, according to the US government,
Speaker 1: though they have become an extension of this larger UM
Speaker 1: cybercrime issue. You know, we we've saw as recently as
Speaker 1: as earlier this year allegations that a different mixing service
Speaker 1: was used, particularly for ransomwares. So, um, it's not only
Speaker 1: this kind of large scale crypto AFT, it's when something
Speaker 1: is taken via extortion, they can you know, kind of
Speaker 1: run it through some of these UM mixing services to
Speaker 1: kind of hide their activity in a more effective way.
Speaker 1: And of course the goal of that is to make
Speaker 1: it harder to trace those funds and ever get them
Speaker 1: back for the people who have been scammed have to
Speaker 1: extort it. Yeah, like you said, pretty much an arms race.
Speaker 1: It is very much as an arms race. It's very
Speaker 1: interesting in the U. S. Government. Look, I don't think
Speaker 1: a few years ago, UM, I'll speak for myself, I
Speaker 1: didn't expect the United States to move as quickly as
Speaker 1: they have in terms of trying to combat some of
Speaker 1: this stuff. We've seen some really big seizures over the
Speaker 1: past year or so that UM not long ago would
Speaker 1: have been obviously significantly more difficult. We know they're trying
Speaker 1: to staff up very rapidly. Is there anything else that
Speaker 1: has surprised you other than perhaps the size and frequency
Speaker 1: of these hacks, like you, as a reporter in cybersecurity,
Speaker 1: suddenly now having to get up to speed on what
Speaker 1: a bridge is and what it makes. Yes, that has
Speaker 1: been that. Thank you for pointing that out. That's one's
Speaker 1: extremely surprising to me. I didn't expect that. But the
Speaker 1: way that these suspected North Korean hackers are attuned to
Speaker 1: the culture of not only Western culture and the US,
Speaker 1: but really like Silicon Valley, there was there was research
Speaker 1: that came out from Google UM not long ago indicating
Speaker 1: that that this group, the Lazarus group, this is the
Speaker 1: same group that carried out the Bangladesh bank heist. The
Speaker 1: same group that targeted Sony Pictures years ago and released
Speaker 1: all of those emails and um inspired a condemnation from
Speaker 1: former President Obama. The same group is now like creating
Speaker 1: fake versions of Indeed dot com creating fake versions of
Speaker 1: a Disney careers page, and they're using those in really
Speaker 1: targeted espionage operations to get a little bit of information
Speaker 1: from a very small, specific set of targets and it works.
Speaker 1: So is really um, you know, this is crime, and
Speaker 1: this is this is geopolitics, and there's a lot of
Speaker 1: ugliness to this and obviously the North Korean government being
Speaker 1: what it is, but some of these tactics are really innovative.
Speaker 1: I mean they're very impressive and very there. They are surprising.
Speaker 1: No wonder they're get hired by crypto companies. Yeah right,
Speaker 1: it's kind of joke. That's a true story. Well, thank
Speaker 1: you so much for being on the podcast. I really
Speaker 1: appreciate you taking the time. Thank you for having me.
Speaker 1: I'm such a fan. You can find more of Jeff
Speaker 1: stones reporting on the Bloomberg Terminal on Bloomberg dot com
Speaker 1: or follow him on Twitter. He's at Jeff Stone five hundred.
Speaker 1: On the next episode of Bloomberg Crypto. Cars, especially luxury cars,
Speaker 1: have always been a marker of wealth, but for many
Speaker 1: crypto investors, no single car has driven so much interest
Speaker 1: as the Lamborghini. To better understand how the Lambo came
Speaker 1: to be one of the most visible status symbols in crypto,
Speaker 1: I'll be joined by Bloomberg Report to Hannah Miller and
Speaker 1: crypto venture capitalist Peter Saddington. This is Bloomberg Crypto, a
Speaker 1: daily podcast from Bloomberg and I Heart Radio. For more
Speaker 1: shows from I Heart Radio, visit the I Heart Radio app,
Speaker 1: Apple Podcasts, or wherever you get your podcasts. Send us
Speaker 1: your comments, questions, or suggestions for the show to Crypto
Speaker 1: at Bloomberg dot net or find us on Twitter. We're
Speaker 1: at Crypto. The supervising producer of Bloomberg Crypto is Vicky Vergalina.
Speaker 1: Our senior producer is Janet Babin. Our producer is Shannon Barrero.
Speaker 1: Associate producer is Thy Butler. Desta wonder At is our engineer.
Speaker 1: Original music by Leo Sidrn. I'm Stacy Maria Shmal. We'll
Speaker 1: be back tomorrow