Fake Interview. Billions Stolen

0:00–0:41 | Welcome and introductions

TOM BAKER: The money is visible, but can anyone stop it? Welcome to TENEX Signal. I'm Tom, and in this episode, we're going all in on the Binance blockchain heist. We're gonna be following the money, and when I say money, it's big money. Six billion dollars in crypto was stolen. Now you may think you know what happened, but here to explain all the details, and next steps is Tyler Moffitt. Tyler, how are you doing?

TYLER MOFFITT: Doing well, Tom. Thanks for having me on. Today, yeah, we're going to follow the money without assuming that you spend your weekends reading these transactions on blockchains and knowing what's going on.

0:41–2:43 | 1. A fake job interview opens the door

TOM BAKER: So, first things first, then, what happened and and what does hacked actually mean in this case?

TYLER MOFFITT: So, yeah, Binance says that its hot wallets were compromised on October 29th. Approximately 6.3 billion in their token assets stolen, variety of different assets. But the company says they will absorb the loss, and the ultimately the FBI attributes the theft to you know North Korea activity. And basically, a hot wallet is it's part of the exchange's online system for moving funds, right? Binance is a centralized exchange, okay? So the assets are under the company's control, and that's different before we get into decentralized finance, but which we'll talk about in a little bit. But Binance is they came out with this November 3rd, their disclosure of their findings. They basically describe this happening from a fake job interview. So an engineer responded to a fake job interview assignment, if that makes sense, downloaded an assignment that contained malware from this fake interview using his company laptop, which just on this aside, that's a huge no, right? Huge no-no. But it happened and it does happen. And so the attackers then from there moved through internal systems, stole deployment credentials, and reached the wallet signing service. Now, this is really big because and this is directly from Binance's initial findings that they disclosed as well. What's interesting is that we actually covered a broader pattern of this in the TENEX Signal issue 77. We we actually talked about North Korean actors using job offers and interviews where they give malware to those interviewers, and then that's how they get access. That's their way in, right? And that TENEX Signal issue actually came out before this hack took place, but it clearly shows that you know we've seen this exact tactic from North Korea, and here it is showcasing the largest to date dollar amount theft in history.

2:43–4:18 | 2. No cryptography was broken

TOM BAKER: Also clearly shows that that poor engineer hasn't subscribed to TENEX Signal I bet he's regretting that now. So then they didn't break or hack the mathematics behind securing cryptocurrency wallets.

TYLER MOFFITT: No, not at all. And you gotta be careful of news stories out there saying that this was some AI zero-day discovery when really it was much simpler, right? A fake job interview task gets an employee to run code on their work computer, right? And that access becomes the route towards the systems that authorized to move money, right? And that matters immensely because you don't have to defeat any cryptography if you can get the system to sign your transaction. If that signature checks out, the payment goes through. And you know, even if the money was never intended to be sent to a criminal, right? And ultimately, that's the part I would want to investigate. How did the attacker get a valid approval for something that they never should have been able to? But anyway, Binance reports that 18,270 Bitcoin went to an attacker controlled address. Now that that was just one part of roughly 6.3 billion in stolen crypto, uh, includes ether, some stable coins and some other assets, right? Um, for comparison though, Bitfinex lost 119,754 Bitcoin. This is back in 2016, and that's according to the Justice Department.

Um, so yeah, over a decade ago, the Bitcoin coin amount was like six and a half times the Bitcoin that was just recently taken from Binance. So the dollar value and the number of Bitcoin are, are two different comparisons, especially when the theft involved several different assets.

4:18–6:08 | 3. Why stopping withdrawals wasn't enough

TOM BAKER: Now you said they got access to the system that signs transactions. That somebody's only ever used a bank account. Explain how that works, if you would. What does controlling a crypto wallet actually let you do?

TYLER MOFFITT: Well, it lets you, you know, approve the moving funds. A blockchain is just it's a shared record of who holds what, right? Your wallet lets you interact with that record, and a digital key authorizes the transfer. Think of it like a a public ledger that's digital. And Binance says the attackers reached the service that provided those approvals so they could make payments the company never intended to make.

TOM BAKER: Okay, Binance stopped withdrawals happening, but why didn't that stop the attacker?

TYLER MOFFITT: So the attacker had already used that access to give their own software permission to use the funds. So according to Binance, that permission worked outside its normal withdrawal system. So in this case, turning off withdrawals closed the normal route of withdrawals, but it didn't cancel the permission the attacker had already created. And Binance basically had to like that's a another thing entirely that they had to do separately, which took more time, right?

TOM BAKER: So they had to stop the theft and try to catch the money that was already gone there.

TYLER MOFFITT: Right. And what they could stop depended on which asset the attacker was holding. So some crypto tokens, they have a uh like a company or a central entity to to the that can freeze those transfers. It's it it differs wildly depending on you know what type of token we're talking about. But most of the big players like Bitcoin, Ethereum, they don't really have that kind of control. And so that really will help explain another part of the story is the attacker used some of the stolen money to borrow a different type of asset.

6:08–9:45 | 4. Borrowing against stolen money

TOM BAKER: Okay, if they can do that by borrowing, can you uh walk me through that?

TYLER MOFFITT: Yeah, so this is another sort of ingenious way of going about it. There are crypto lending services that run through software. The one example is DeFi or or decentralized finance. Just to give you an example, let's say I put in a thousand dollars worth of crypto, could be Ethereum, USDT, whatever I want, as a security for a loan. That service will let me borrow like six hundred or seven hundred dollars worth of an asset. And you can do this all of it entirely without any central entity or or KYC, if you will. It's all just do you have the asset in a wallet that you control the keys to? Great. Then then we'll let you, you know, we'll issue you collateral based on that. And these are just round numbers for an example. And the the service that was doing this, the decentralized lending service, was called Aave, and they were the platform used in question for this heist. And so my original thousand dollars in my hypothetical scenario, it stays tied up and back to the loan, and and I owe interest against it. That's all coded in the the smart transaction for it, and the collateral can be sold if it no longer provides enough backing, means if the price goes down or something happens, it's not worth enough. Great. That they can collect it if things go wrong. It's called liquidation. People are familiar with that term. So where does the stolen money fit? Right. So USDT is it's tether, tether's issue token on the Ethereum blockchain that is linked to the dollar, if that makes sense. One USDT is worth one dollar always, and that's its purpose, right? It's what it's used to be. It's very useful if you're trying to trade into dollars in a lot of these exchanges, whether you want to buy like Bitcoin, Ethereum, or Bonk or some other crazy crypto coin someone came out with, and usually either pair it with Bitcoin or something like USDT, right? If you want to stick in dollars, you go to USDT. Anyway, this incident used uh from Binance, they stole USDT and they supplied to Aave this decentralized, you know, loan collateral funding 60 million dollars in USDT, and they provided it and then borrowed roughly 45 million dollars worth of Ethereum, essentially. It was a wrapped Ethereum, which is another form of Ethereum, but the purpose is they were able to get something out of assets on a token that Tether could have frozen, right? And that's the whole purpose behind this, if that makes sense.

TOM BAKER: Okay, explain this to me. They've stolen 60 million, they put it up as collateral, and they borrow another 45 million. Why would they do that instead of just keeping the 60 million?

TYLER MOFFITT: They haven't turned 60 million into a hundred and five million position that they can freely spend. There's still that debt. What they've done is they've basically said they're willing to lose the collateral and they've still got that borrowed asset. And that's ultimately the economic uh incentive here. They would accept less value if they have you know more free ability to use that new one. So for an ordinary borrower, walking away from a collateral is a loss, right? Liquidation is a loss, but for a thief, the original collateral, which was stolen money, they didn't even really earn, right? That changes the economics entirely. It it also doesn't exactly make the proceeds clean, and the deposit and the borrowing leave a trail, which is how I'm able to explain what they did here in the first place.

9:45–12:01 | 5. Why crypto instead of banks

TOM BAKER: Now, is that then while they go after crypto, fewer opportunities, I guess, for someone to stop the money?

TYLER MOFFITT: Yeah, it's definitely part of the appeal. Don't get me wrong, North Korea, their actors have absolutely gone after banks too. The Justice Department has attributed about $81 million in Bangladesh bank theft in 2016. And they also compromise the bank systems and fraudulent payment instructions. And but those instructions, you have to realize, they go through SWIFT. And that's the messaging network that banks use to communicate payments, and banks themselves hold and transfer the funds. And so that does give defenders a place to intervene. And SWIFT has come in handy many times there because banks can flag suspicious payments, hold the transfers for review, block funds when you know, and block funds when sanctions require it. And so those controls they they create obstacles for criminals, right? And sanctioned groups or terrorist organizations and things like that. They don't they don't stop every theft, but getting a payment instruction accepted doesn't guarantee you'll get usable money out of the other end.

TOM BAKER: And a blockchain transfer doesn't necessarily pass through those banks.

TYLER MOFFITT: Not at all. That's exactly correct. It's part of the reason it was created that way. I mean, uh, it wasn't created to be such a lucrative avenue of immutable ledger system that criminals will leverage. But yeah, basically you could move assets between wallets. There's no bank, but it's approving each transfer. You know, it's useful for legitimate users, and it's also attractive for someone trying to move stolen money before anybody can intervene. It doesn't make crypto untraceable. Obviously, we're able to talk to you about it because of the public ledger system and being able to audit and see where all this goes, or nor does it make every token impossible to freeze. Obviously, Tether did try to freeze these assets, and Aave did as well. They had some controls where they were trying to freeze, but these criminals were so well versed in the ecosystem of decentralized finance that they sort of preemptively knew a lot of this stuff was going to be tried and were able to sort of get in and leverage and collateral and take out what they could of a percentage before any of this sort of took place. And uh that's why they're able to monetize as much as they could through this.

12:01–13:09 | 6. Why North Korea keeps showing up

TOM BAKER: I think it's fair that I should put North Korea's side of the story here. They they've denied claims that it was behind all of this. They've called the allegations absurd rhetoric. They said on Tuesday that the accusations are another sinister attempt by the US to damage their public image. But why do they keep showing up in all of these stories?

TYLER MOFFITT: Well, I mean, there's a state funding objective behind it, but a successful theft can bring in money despite sanctions. So the incentive goes well beyond just one criminal getting rich, right? The United States, Japan, South Korea have linked these thefts to funding North Korea's like prohibited weapons program. The FBI has also attributed roughly 1.5 billion Bybit theft, which was last year, early last year, to North Korea. So, I mean, we shouldn't pretend that you know we rank every source of revenue in North Korea's economy, but these repeated thefts show why this has become such a serious security problem, right? The potential return here is enormous, and this is the most enormous heist in history we've seen.

13:09–14:56 | 7. Following the money trail

TOM BAKER: We're pretty sure it's not a hacker in a hoodie in uh his bedroom somewhere. Once then they start swapping assets, have they lost the investigators?

TYLER MOFFITT: So I wouldn't say automatically, no, they haven't. Public blockchains, these ledgers, they they they do leave a detailed transaction trail, which is how I'm able to talk to you about it. An address isn't necessarily a real-world identity, but investigators can follow connections and combine that record with other evidence. So a swap changes what you're holding. A bridge connects activity across networks, neither automatically erases where the value came from, ultimately. But there are companies out there like Chainalysis, which do a really good job of trying to track these criminals and everything you do. They usually focus on ransomware, but this was just from uh a social engineering tactic that was a crazy amount.

TOM BAKER: Issue 76 of TENEX Signal had a story about people laundering money for these groups. Is that the other half of this?

TYLER MOFFITT: Yeah, no, we definitely covered reporting that the you know Chinese criminal network had allegedly laundered more than a billion dollars from multiple crypto thefts for for Lazarus crew. That comes from a blockchain investigator's findings. It doesn't establish that that that this network handled the Binance money or anything like that, but it it explains that the story doesn't end at theft. Getting control of the tokens and then turning them into money that you can actually use are separate problems, right? There can be other people involved in that second part and taking a cut to move the proceeds, of course. So the headline theft value isn't the same money as the regime has successfully spent or put back in its bank, if that makes sense. The freezes they were able to do, recoveries, losses along the way with collateral and any fees they give for any other laundering they may they might do that. That all is gonna take away from it, but they're still gonna be sitting with a pretty penny.

14:56–16:08 | 8. What to take back to work

TOM BAKER: Now I'm presuming that to not everyone who listens to this podcast runs a crypto exchange. So what should those people be taking back to work?

TYLER MOFFITT: Yeah, no, it's still implications here. You gotta look at the systems that turn an instruction into an irreversible action, like who can authorize it, what limits it reach, you know, and what can an attacker can reuse an approval. So for a SOC analyst, that means understanding what an identity can do. Not just whether its login looks unusual. For a security leader, it means knowing whether your containment plan reaches the system executing the action.

TOM BAKER: So seeing the attack then is only part of the job.

TYLER MOFFITT: Exactly. And if I'm watching an attacker move money, I need to know who can stop the next transaction, right? Is it our team? Is it the exchange? A token issuer? Do we already have the response worked out or are we figuring out where the balance drops? But an alert can tell you that money is leaving, but your controls determine whether the next payment actually goes through. That's what I'd suggest to other security teams. And to important developers out there, if you're applying for job interviews and they have a task for you, I recommend not doing it on your company laptop that has access to important systems.

16:08–16:45 | Close

TOM BAKER: Great advice, Tyler. Thank you very much.

TYLER MOFFITT: Thanks for having me.

TOM BAKER: And Tyler will be back next week with more wise words inspired by the TENEX Signal newsletter. Find out how to subscribe in the show notes. And whilst you are in the subscribing mood, why don't you do the same to this podcast? Thanks for listening and goodbye.

Sources

• Subscribe to the TENEX Signal newsletter
• Episode 3 on Buzzsprout