WEBVTT

1
00:00:02.515 --> 00:00:04.877
All right, Redbird, you are at TRM Labs.

2
00:00:05.277 --> 00:00:09.200
TRM Labs, you guys are just on the front lines of any big exchange hack.

3
00:00:09.220 --> 00:00:10.781
Let me start with this question here.

4
00:00:11.442 --> 00:00:20.048
The day of the Binance exchange hack, this was like a mythological day that never existed, only in our imaginations, but it's finally here.

5
00:00:20.649 --> 00:00:21.770
Was this expected?

6
00:00:21.930 --> 00:00:28.335
Was a Binance hack kind of expected in your possible futures, or were you surprised to see this?

7
00:00:28.855 --> 00:00:31.916
Look, David, thank you for having me on in this crazy moment.

8
00:00:32.637 --> 00:00:38.359
If I look scruffier than usual, it's because I, as you indicated, sort of haven't slept all that much in the last 24 hours or so.

9
00:00:39.499 --> 00:00:45.402
Look, I think that as hackers have gotten more and more sophisticated, we're seeing higher and higher numbers.

10
00:00:45.942 --> 00:00:47.823
If you ask me, you know, a year or

11
00:00:48.923 --> 00:00:55.327
or so ago, that there'd be a $1.5 billion hack on Bybit, I would have said, you know, that's crazy, right?

12
00:00:55.367 --> 00:01:00.470
Like we're talking about a billion dollars a year by North Korea at the most, and then it happened in one day.

13
00:01:01.371 --> 00:01:10.957
We've now seen North Korea steal about six, seven, eight billion in the last six years or so, and then we saw them steal six billion yesterday evening.

14
00:01:11.417 --> 00:01:16.341
So, I mean, the threat actors on the other side of these hacks are becoming more and more sophisticated.

15
00:01:16.601 --> 00:01:22.927
There's more money within the crypto ecosystem, which makes, you know, crypto a target for these types of cyber attacks.

16
00:01:23.447 --> 00:01:29.152
And I know we'll probably get to this later, but AI is really supercharging these types of operations.

17
00:01:29.512 --> 00:01:33.275
So am I surprised that there's a $6 million hack of Binance?

18
00:01:33.355 --> 00:01:37.639
I don't think I'm really surprised about much of anything right now in this ecosystem.

19
00:01:39.086 --> 00:01:43.228
The news broke about 12 hours, a little bit more than 12 hours ago.

20
00:01:43.268 --> 00:01:49.191
So like last evening, Eastern time, maybe 6, 7, 8 p.m. Eastern time.

21
00:01:49.251 --> 00:01:50.832
What have you been doing?

22
00:01:50.952 --> 00:01:53.593
Put us in the life of Ari over the last like half of a day.

23
00:01:53.753 --> 00:01:55.294
Yeah, no, it's a great question.

24
00:01:55.514 --> 00:01:57.795
And, you know, I'll tell you, I...

25
00:02:00.254 --> 00:02:03.015
I've seen the ecosystem come together in really extraordinary ways.

26
00:02:03.035 --> 00:02:07.296
And we'll get into the work of Tether and Circle, I'm sure, in all of this and really beyond.

27
00:02:07.676 --> 00:02:09.857
But I was really proud of what happened at TRM, right?

28
00:02:09.977 --> 00:02:15.058
I mean, immediately, the team started reaching out to our clients and customers.

29
00:02:15.858 --> 00:02:19.159
What, you know, smaller exchanges potentially could be impacted.

30
00:02:19.279 --> 00:02:22.020
Our partners that reached out to our partners at Binance.

31
00:02:22.160 --> 00:02:23.940
We are a remote first company.

32
00:02:23.980 --> 00:02:26.921
So we created a war room within Slack.

33
00:02:27.321 --> 00:02:35.322
where our blockchain intelligence team, where our global investigations team was coordinating and then reaching out to our Beacon Network partners.

34
00:02:36.343 --> 00:02:40.363
The Beacon Network is the largest information sharing network within the crypto ecosystem.

35
00:02:40.703 --> 00:02:54.426
It accounts for about 85% of all centralized crypto volume, think Binance, Coinbase, Kraken, OKEx, Robinhood, Stripe, PayPal, and 100 global law enforcement agencies, all coordinating for a night like last night.

36
00:02:55.466 --> 00:03:00.628
and really kind of being able to leverage those resources, allowing us to move really, really quickly.

37
00:03:00.949 --> 00:03:09.312
So I would say it was an all-hands-on-deck, true war room mentality, where I also wanted to make sure that we were getting out information to the community as we could.

38
00:03:09.652 --> 00:03:12.394
So I was scrambling on the report we ultimately put out last night.

39
00:03:13.034 --> 00:03:22.358
My colleague, Nick Carlson, who is too humble to like when I say stuff like this, I think is the foremost expert in the world on North Korea and cryptocurrency.

40
00:03:24.919 --> 00:03:29.584
talking to everyone he possibly could internally, externally, to really coordinate a lot of this effort.

41
00:03:29.844 --> 00:03:40.315
As a result of the effort that you, TRM, and the Beacon Network put in last night, is that why money was saved, assets were frozen, user funds were recovered?

42
00:03:40.375 --> 00:03:43.699
Can you talk about what the actual positive results of all that were?

43
00:03:43.719 --> 00:03:46.642
Sure, yeah, and I certainly wouldn't take credit for that.

44
00:03:47.654 --> 00:03:48.575
for all or any of it.

45
00:03:48.775 --> 00:03:52.338
I think that like what we did with Beacon is really bringing the community together.

46
00:03:52.358 --> 00:04:06.128
And essentially the way Beacon works is as funds are moving in real time, law enforcement investigators, private investigators like ZachXBT and others are flagging illicit proceeds as they're moving in real time.

47
00:04:06.489 --> 00:04:08.310
And they send out an alert to this network.

48
00:04:08.650 --> 00:04:11.753
So the real work that is being done here is like we bring the community together

49
00:04:12.293 --> 00:04:20.038
But it's these investigators who are flagging addresses and it's the exchanges who then are blocking them and working with law enforcement to seize back those funds.

50
00:04:20.438 --> 00:04:26.381
The two biggest players last night, again, outside of the Beacon Network, were certainly Circle and Tether.

51
00:04:26.921 --> 00:04:28.923
And what they did was absolutely extraordinary.

52
00:04:29.183 --> 00:04:38.068
I think that to me, if there are two headlines on this attack, it's one, obviously, this is the largest bank robbery in human history by magnitudes.

53
00:04:38.948 --> 00:04:41.690
I was in this Netflix documentary called The Biggest Heist Ever.

54
00:04:42.070 --> 00:04:43.490
That was 70 million at the time.

55
00:04:44.211 --> 00:04:49.633
Even 4.2 was recovered in the Bitfinex case, right?

56
00:04:49.954 --> 00:04:54.116
This is bigger out the door than we could even imagine.

57
00:04:54.376 --> 00:04:56.136
So obviously, the number is really important.

58
00:04:56.477 --> 00:04:58.638
But to me, the response is really the story, right?

59
00:04:58.658 --> 00:05:03.460
Like literally, Tether and Circle were able to freeze Tether

60
00:05:03.600 --> 00:05:10.682
40% of the stolen funds last night, about $2.4 billion within an hour or so of the hack.

61
00:05:11.282 --> 00:05:20.505
That really shows the power and promise of what the crypto ecosystem is able to do from a compliance perspective, from a technology perspective, from an investigations perspective.

62
00:05:20.945 --> 00:05:23.726
So I think that the number of the hack is a huge story.

63
00:05:24.126 --> 00:05:27.867
But literally, I mean, more was recovered last night than any hack that has actually ever happened.

64
00:05:28.567 --> 00:05:30.268
And I think that's a really important story here too.

65
00:05:30.648 --> 00:05:31.909
I know this just happened.

66
00:05:31.929 --> 00:05:35.271
So we're on like hour 15, 16 of this.

67
00:05:36.192 --> 00:05:37.613
What's left to settle?

68
00:05:38.473 --> 00:05:42.416
When you're off of this live stream and you go back to work, I believe you haven't slept.

69
00:05:42.476 --> 00:05:44.057
So I hope you get some rest in shortly.

70
00:05:44.097 --> 00:05:45.958
But like what's left to do?

71
00:05:46.058 --> 00:05:48.440
I know like some, the ether is gone.

72
00:05:48.500 --> 00:05:49.741
Like the Bitcoin is gone.

73
00:05:49.781 --> 00:05:53.643
Like the permissionless immutable assets, those are just going to be hard to recover.

74
00:05:54.043 --> 00:05:57.005
So like what's left to do today and this weekend and next week?

75
00:05:57.386 --> 00:05:59.327
So I hope you're not entirely right.

76
00:05:59.607 --> 00:06:00.987
I do think it's going to be really hard.

77
00:06:01.087 --> 00:06:15.611
It's always becomes harder and harder to recover in that sort of decentralized ecosystem where funds are starting to spread out, starting to move other places, where you're using smaller OTC brokers to off-ramp funds, to convert funds from crypto to cash.

78
00:06:15.871 --> 00:06:16.952
I can get into that in a moment.

79
00:06:17.592 --> 00:06:25.994
But the reality is that, you know, between the Beacon Network and just the way that law enforcement works with the exchange community today, I still believe that there's hope.

80
00:06:26.934 --> 00:06:33.617
So just to give your listeners a sense, as this attack happened, we're watching funds flow from Binance.

81
00:06:33.637 --> 00:06:37.339
And we put a bunch of graphs in our report last night that hopefully visualize this.

82
00:06:37.619 --> 00:06:47.083
But as you're seeing funds move, what we're doing is we're counting those funds, we're watching them go, we're labeling the addresses where those funds go, and we're watching every dollar move.

83
00:06:47.963 --> 00:06:59.549
So the hope is not just, hey, you know, obviously stablecoin issuers have these really unique capabilities to immediately freeze or what I call burn and then ultimately reissue that asset, right?

84
00:06:59.569 --> 00:07:06.612
You're able to actually pull those funds out of an illicit actor's wallet address and put them into an inaccessible wallet address.

85
00:07:06.692 --> 00:07:08.173
It's just extraordinary capability.

86
00:07:08.633 --> 00:07:18.042
But for all the other funds, the Ether, the Bitcoin, potentially Bitcoin as we see the laundering process move on, that becomes much harder, but not impossible.

87
00:07:18.463 --> 00:07:26.711
So as those bad actors are, well, as North Korea is trying to off-ramp those funds through exchanges, we need to use the Beacon Network.

88
00:07:26.751 --> 00:07:31.375
We need to just use legal process to try to block and ultimately seize back those funds.

89
00:07:31.696 --> 00:07:32.857
Because the problem here is, right?

90
00:07:34.160 --> 00:07:35.820
This recovery effort is absolutely extraordinary.

91
00:07:35.840 --> 00:07:39.921
Again, like hats off to Circle and Tether for what they did last night for this ecosystem.

92
00:07:40.881 --> 00:07:45.602
But even with those funds out of play, it's still the largest hack ever by about 2X.

93
00:07:46.182 --> 00:07:47.903
I mean, so we're talking about a lot of money.

94
00:07:48.403 --> 00:07:54.324
And I guess the last point I'd make on this, and we can kind of get into this to the extent it's interesting, is it's North Korea.

95
00:07:55.264 --> 00:08:00.565
And, you know, when we talk about a hack or, you know, hackers or, you know, cyber criminals,

96
00:08:01.545 --> 00:08:03.247
They're going to use the funds for a lot of different reasons.

97
00:08:03.267 --> 00:08:04.769
Some of it is just purely greed.

98
00:08:05.389 --> 00:08:13.678
You want to make money, you want to buy cars, you want to buy yachts or whatever it ultimately is, the way Rosal Khan lived in the Bitfinex hack.

99
00:08:14.218 --> 00:08:23.868
But when it's North Korea, we're talking about destabilization, we're talking about nuclear weapons ambition, we're talking about really destabilizing the Korean Peninsula and beyond.

100
00:08:25.009 --> 00:08:30.011
This is a country with, I think, estimates around a $20 billion economy.

101
00:08:30.591 --> 00:08:33.172
I mean, this is a banana republic by all accounts.

102
00:08:33.532 --> 00:08:35.793
They stole $6 billion last night.

103
00:08:36.573 --> 00:08:39.454
That's a third of their overall economy.

104
00:08:39.674 --> 00:08:41.334
I mean, just like let that sit there for a second.

105
00:08:41.354 --> 00:08:42.335
That is crazy.

106
00:08:43.235 --> 00:08:49.697
So when we're talking about North Korea, to me, it puts an entirely other angle on any type of theft like this.

107
00:08:49.717 --> 00:08:51.337
It becomes a global security issue.

108
00:08:51.537 --> 00:08:55.618
I know that when there's hacks of this size, we saw this with the Bybit hack.

109
00:08:55.638 --> 00:08:58.239
The FBI got involved immediately.

110
00:08:58.859 --> 00:09:01.860
What's been the engagement with law enforcement looks like?

111
00:09:02.380 --> 00:09:05.220
What role do they play when it comes to hacks like this?

112
00:09:05.340 --> 00:09:07.401
Law enforcement plays a really critical role here.

113
00:09:07.581 --> 00:09:11.922
And look, I mean, I am a huge believer that between technology and community,

114
00:09:12.863 --> 00:09:21.112
you know, tracking and tracing plus building out that beacon network type of collaboration, we can get a lot done, but we don't have legal process, right?

115
00:09:21.332 --> 00:09:29.161
So ultimately, an exchange or stablecoin issuer is going to need a subpoena or a search warrant or a seizure warrant in order to actually take those funds.

116
00:09:30.062 --> 00:09:36.163
And the funds that we seize back, there's likely going to be a civil forfeiture process, which is going to require court proceedings.

117
00:09:36.523 --> 00:09:45.205
So that's when you really need, you know, a Department of Justice or a global prosecutor's office or law enforcement to really get involved.

118
00:09:45.225 --> 00:09:47.265
There's, you know, there are limitations, right?

119
00:09:47.646 --> 00:09:55.567
Zach XBT is the best in the world or one of the best in the world at tracking and tracing funds, but he can't serve that subpoena on the exchange to ultimately get those underlying records.

120
00:09:55.827 --> 00:09:57.968
And that's when you need that sort of real coordination.

121
00:09:58.188 --> 00:09:59.768
And that's what you're seeing from law enforcement.

122
00:09:59.788 --> 00:10:00.128
for sure.

123
00:10:00.228 --> 00:10:06.531
There's this conversation around EIP 7702 and how the actual hack was executed.

124
00:10:06.551 --> 00:10:17.617
I know you're not Binance, you're not inside of their internal operations, so you only have so much limited perspective here, but what can you say about how the hack actually was executed and how novel of an exploit that was?

125
00:10:17.797 --> 00:10:44.336
Yeah, it's probably the one thing I would mostly stay away from here, only because I know that Binance has come out with some information, which I'm tracking, which honestly, their narrative around, I believe, an engineer whose laptop or computer systems was hacked in order to gain access to those codes, those private keys, is consistent with what we were seeing on chain, the way this sort of exploit happened and the way those funds ultimately left the platform.

126
00:10:44.856 --> 00:10:49.842
But I'd probably leave ultimately that to Binance and ultimately figure out what happened over the course of a few days.

127
00:10:49.882 --> 00:10:54.288
I mean, if you think through drift and some of the other activity that we saw over the summer,

128
00:10:56.518 --> 00:11:00.722
There could be an extraordinary story here of social engineering and how they ultimately gained access.

129
00:11:00.742 --> 00:11:01.964
And we'll see how kind of all that played out.

130
00:11:02.064 --> 00:11:16.698
One thing I think that's really important and really how we attributed North Korea in the first place is, you know, ultimately we we saw, you know, cash withdrawals about 36 hours ahead of the attack, small tornado cash withdrawals.

131
00:11:16.718 --> 00:11:17.639
Yeah.

132
00:11:18.519 --> 00:11:22.422
Sorry, small tornado cash withdrawals at least 36 hours ahead.

133
00:11:23.522 --> 00:11:32.788
The attack code was tested on two wallets, then rehearsed on a third with test funds routed back to the attacker and only then installed on that Binance hot wallet.

134
00:11:33.288 --> 00:11:47.757
So what I think the story is going to ultimately tell is a long term, very deliberate effort to plan, coordinate and breach Binance's cybersecurity systems.

135
00:11:48.088 --> 00:12:02.242
This is how I understand when the Lazarus Group identifies a potential attack vector, they kind of set up a dummy exploit and then they exploit it live, like on chain, like they create a fake Binance wallet and then they see if they can actually do it live.

136
00:12:03.764 --> 00:12:10.691
Is it possible to see these things come ahead of time based off certain patterns of like, oh, there's a bunch of gas transactions coming out of TornadoCash?

137
00:12:11.471 --> 00:12:16.515
Uh, this is what you would expect to see in case of like some actual larger attack coming.

138
00:12:16.795 --> 00:12:19.958
Were there any signs that you could reveal ahead of time that this was coming?

139
00:12:20.699 --> 00:12:26.163
So, you know, obviously this is that staging and rehearsal pattern that's really become a signature for, um,

140
00:12:26.603 --> 00:12:28.185
for North Korea cyber actors.

141
00:12:28.826 --> 00:12:46.447
And sure, you know, obviously these are things that we can see on chain, but the reality is, are they really standing out in a way that, you know, you see sort of this, it's, you know, analogies aren't always useful, but in this case, it's like, you know, is an individual acting a certain way that is indicative of, you know,

142
00:12:47.924 --> 00:12:53.666
causing a murder or a school shooting or, you know, like it's really easy to Monday morning quarterback what we should or shouldn't have seen.

143
00:12:53.686 --> 00:13:01.049
But I think the reality is, yeah, I mean, there's indicia on chain, but there's a lot of activity on chain and really hard to sort of see.

144
00:13:01.629 --> 00:13:02.890
But I think that's what we're seeing here.

145
00:13:02.950 --> 00:13:06.011
And in large part, you know, you asked me how my night was last night.

146
00:13:07.031 --> 00:13:10.073
Probably the most extraordinary moment was about 9, 9.30, 11.

147
00:13:11.433 --> 00:13:16.935
maybe 10 o'clock, we were about to put out this report, basically kind of walking through the hack.

148
00:13:17.415 --> 00:13:25.657
And right before we did that, my colleague, Nick Carlson, former FBI analyst, again, foremost expert in the world on North Korea, says this was North, he says to me, this was North Korea.

149
00:13:26.338 --> 00:13:28.478
And we really started to go through the why.

150
00:13:28.918 --> 00:13:31.439
And part of it very much is that staging and rehearsal piece.

151
00:13:31.799 --> 00:13:35.840
But we're also connecting addresses that we've seen in other hacks, you know, Drift.

152
00:13:36.261 --> 00:13:40.942
In particular, there's a lot of the similar signatures from Bybit,

153
00:13:41.582 --> 00:13:50.511
But that but your question is really getting to sort of how we started to really identify and believe with pretty high degree of confidence that that North Korea was involved here.

154
00:13:50.671 --> 00:13:53.474
Does North Korea care about being identified?

155
00:13:53.955 --> 00:14:00.101
Like if they exploit something and they get the Bitcoin, the Ether, like the bear assets inside of their their wallets.

156
00:14:00.621 --> 00:14:04.585
Like, we can't go do something because they have nuclear bombs.

157
00:14:04.705 --> 00:14:08.189
And so, like, do they really care about covering their footsteps?

158
00:14:08.489 --> 00:14:09.029
Not that much.

159
00:14:09.190 --> 00:14:12.933
And I think that's really what's different about North Korea when you look.

160
00:14:13.013 --> 00:14:17.698
And part of how we have, I think, carved out signatures over the years for North Korea, right?

161
00:14:17.718 --> 00:14:19.420
You know, you think of a painting painting.

162
00:14:20.660 --> 00:14:31.324
I think people like Nick and Christian Chesky and others on our global investigations team, they look at this as an art and they're watching how North Korea is operating and see these signatures.

163
00:14:31.344 --> 00:14:34.705
But yeah, part of their signature has always been, hey, we're gonna steal as much money as we can

164
00:14:35.732 --> 00:14:37.933
We don't really care if we lose some here or there.

165
00:14:37.953 --> 00:14:46.918
I mean, they lost a lot last night, but they also made off with arguably, well, what would in and of itself be the largest hack ever by two acts, right?

166
00:14:48.019 --> 00:14:52.861
So they care a lot less about, you know, getting caught because no one's going to jail.

167
00:14:52.961 --> 00:14:54.322
There's never going to be an extradition.

168
00:14:54.962 --> 00:14:57.744
There's likely not going to be a criminal prosecution of any kind.

169
00:14:58.284 --> 00:15:01.766
And this is bank robbery for them at the speed of the internet.

170
00:15:02.226 --> 00:15:05.288
So I think that's always been sort of a signature for them.

171
00:15:05.328 --> 00:15:12.712
It's like, we're going to steal as much as we can, move it as fast as we can, and try to convert it for weapons proliferation and destabilizing activity.

172
00:15:13.032 --> 00:15:16.494
Part of what I believe is that we have to make them care more.

173
00:15:17.314 --> 00:15:25.659
And, you know, I talked a lot about cyber letters of Mark and this idea of using, you know, the private sector to go after cyber actors.

174
00:15:26.399 --> 00:15:29.061
We talk a lot about offensive cyber.

175
00:15:30.101 --> 00:15:43.607
When I was a prosecutor myself and Nick, who I've mentioned several times when he was at the FBI and a colleague of mine, Zia Faruqi, who's now a federal judge and others, issued a Patriot Act subpoena on a Chinese bank for records in a North Korea money laundering case.

176
00:15:44.147 --> 00:15:45.688
We need to put diplomatic pressure on.

177
00:15:46.288 --> 00:15:49.530
on China, in order to act, right?

178
00:15:49.550 --> 00:15:54.012
That is still an important trading partner, an important partner for North Korea.

179
00:15:54.052 --> 00:15:59.354
So there are things we can do beyond hardened cybersecurity at cryptocurrency exchanges.

180
00:15:59.394 --> 00:16:00.835
There are offensive tools we can use.

181
00:16:01.795 --> 00:16:05.377
To me, if they're stealing $6 billion, we should do everything we can to ultimately steal it back.

182
00:16:06.037 --> 00:16:09.819
So I think to your question, they don't care because no one's going to jail, and they're

183
00:16:10.519 --> 00:16:13.340
And it becomes very, very hard to ultimately seize those funds back.

184
00:16:14.161 --> 00:16:18.002
But I think there are pressure points that we could put on them that would make them care more.

185
00:16:18.123 --> 00:16:25.026
Yeah, it does feel very lame of us in the West on the United States side of things that like North Korea just hacks billions of dollars.

186
00:16:25.666 --> 00:16:28.647
And we're just like, well, it's North Korea.

187
00:16:28.907 --> 00:16:30.728
I can't do anything about it.

188
00:16:31.569 --> 00:16:31.949
How much?

189
00:16:33.078 --> 00:16:34.539
more can we do?

190
00:16:35.080 --> 00:16:45.549
Like, if you were in charge, if you were in the U.S. government and you were in charge of, like, standing up like a cyber international police division, like, what would you try and do?

191
00:16:45.869 --> 00:16:47.631
Sure, well, first of all, look, I am...

192
00:16:48.371 --> 00:16:50.212
not in the national security space anymore.

193
00:16:50.292 --> 00:16:52.012
I'm not a senior government official.

194
00:16:53.413 --> 00:16:56.034
I was a prosecutor for many years and spent time at Treasury.

195
00:16:57.114 --> 00:17:06.738
So, but I do believe that our national security apparatus, our Department of War, our intelligence community are doing a lot of this work today.

196
00:17:07.899 --> 00:17:08.059
Right.

197
00:17:08.099 --> 00:17:09.520
I guess they're just not disclosing it to people like me.

198
00:17:09.540 --> 00:17:10.240
Exactly.

199
00:17:10.761 --> 00:17:11.141
Or me.

200
00:17:12.202 --> 00:17:15.864
But I believe we can, I always believe we can do more, especially in this space.

201
00:17:16.204 --> 00:17:17.926
And part of it is just that diplomatic pressure.

202
00:17:18.006 --> 00:17:20.528
And to me, like all roads lead to China.

203
00:17:20.548 --> 00:17:28.673
You know, one other piece to this, and we saw that in the Bybit hack, is that eventually North Korea turns these stolen funds over to professional money laundering networks.

204
00:17:28.693 --> 00:17:30.455
I think we talked about this earlier.

205
00:17:30.995 --> 00:17:33.816
a few months ago on the show more generally.

206
00:17:34.116 --> 00:17:38.437
But if we haven't seen that here, we're going to see that here, right?

207
00:17:38.477 --> 00:17:55.101
North Korea understands that, hey, we can sell these funds, take a percentage and call it a day and let these Chinese organized crime groups try to use their network of OTC brokers and others to convert these funds to cash.

208
00:17:55.121 --> 00:17:56.461
We see cartels do the same thing.

209
00:17:56.501 --> 00:17:59.542
We see these transnational pig butchering networks do the same thing.

210
00:18:01.362 --> 00:18:05.445
But how do we put pressure on the Chinese government to put pressure on organized crime, right?

211
00:18:05.725 --> 00:18:07.326
So I think there are levers we can pull.

212
00:18:07.346 --> 00:18:10.207
I mentioned a Patriot X subpoena, offensive cyber.

213
00:18:10.828 --> 00:18:15.770
There are a lot of levers we can pull to really, really put pressure on this regime.

214
00:18:16.271 --> 00:18:19.212
But the reality is that, you know,

215
00:18:20.353 --> 00:18:21.193
This is not a Russia.

216
00:18:21.594 --> 00:18:22.594
This is not an Iran.

217
00:18:22.914 --> 00:18:24.375
This is not a China, right?

218
00:18:24.395 --> 00:18:31.418
This is essentially a banana republic, an entirely rogue regime who has never really cared that much about consequences.

219
00:18:31.798 --> 00:18:37.360
I've been trading crypto for almost a decade and I've used so many different wallets, exchanges, aggregators, or front ends.

220
00:18:37.480 --> 00:18:48.865
And I'm basically always looking for the same thing, just one interface with a deep liquidity across a bunch of chains and assets where I can access markets like perps, earn yield, trade confidentially, and still control all of my funds.

221
00:18:49.005 --> 00:18:49.986
And I've never really found it.

222
00:18:50.006 --> 00:18:54.028
And I'm just always switching wallets, juggling gas fees, or getting eaten by slippage.

223
00:18:54.208 --> 00:18:57.030
But near.com feels fundamentally different to me.

224
00:18:57.130 --> 00:19:01.453
I can do anything I want from any chain and keep all of my activity confidential.

225
00:19:01.553 --> 00:19:03.674
Crypto, tokenized assets, perps, payments.

226
00:19:03.855 --> 00:19:05.936
I can even earn yield confidentially.

227
00:19:06.116 --> 00:19:09.218
One account, over 30 chains, confidential by default.

228
00:19:09.338 --> 00:19:11.099
It's the way that crypto ought to work.

229
00:19:11.239 --> 00:19:16.763
And it's powered by Near, which has moved over $30 billion cross-chain, uses post-quantum signatures,

230
00:19:16.903 --> 00:19:19.607
And that's run over five years on mainnet with zero downtime.

231
00:19:19.787 --> 00:19:23.112
Near.com is the best way to be on-chain and be in control.

232
00:19:23.312 --> 00:19:28.660
Get 20% of your trading fees back on near.com using the bankless link in the show notes, not investment advice.

233
00:19:28.921 --> 00:19:32.366
Dollar stable coins taught Latin America how to store value on-chain.

234
00:19:32.526 --> 00:19:37.149
RIPIO is taking that same idea and bringing it to the currencies people actually use every day.

235
00:19:37.269 --> 00:19:49.256
With wrapped fiat, RIPIO is putting more than a decade of experience powering crypto infrastructure for leading companies across Latin America behind a suite of six local currency stable coins covering Argentina, Brazil, Mexico, Colombia, Chile, and Peru.

236
00:19:49.356 --> 00:19:57.421
Each is pegged one-to-one to its local currency and fully backed by reserves held in regulated financial institutions with independent attestations published for each token.

237
00:19:57.501 --> 00:20:00.503
But wrapped fiat is not just designed to sit there, it's built to move.

238
00:20:00.643 --> 00:20:07.365
The suite is live across 10 EVM chains with liquidity and integrations already spanning platforms like Morpho, Uniswap, and Chainlink.

239
00:20:07.545 --> 00:20:16.828
Users can move between local payment rails like Pix and Spey, and matching wrapped fiat one-to-one in real time with zero fees on both on-ramps and off-ramps and no FX conversion.

240
00:20:16.988 --> 00:20:18.930
local rails in, on-chain in the middle.

241
00:20:19.091 --> 00:20:24.037
And for builders, Ripio offers APIs, webhooks, widgets, and a sandbox just from day one.

242
00:20:24.217 --> 00:20:27.801
Start building with wrapped fiat today at platform.rippio.com.

243
00:20:27.861 --> 00:20:30.625
Your checking account isn't public, so why should your crypto be?

244
00:20:30.845 --> 00:20:33.909
As AI gets more powerful, your privacy gets weaker.

245
00:20:34.049 --> 00:20:40.655
Connecting your identity to your financial history on chain or off is the easiest it's ever been and will only get easier from here.

246
00:20:40.855 --> 00:20:45.819
Every data breach adds another piece to the puzzle and every public transaction leaves a trail back to you.

247
00:20:45.959 --> 00:20:48.622
And when your wealth is visible, you become a target.

248
00:20:48.702 --> 00:20:50.924
Money that can be seen can be stolen.

249
00:20:51.044 --> 00:20:54.627
Being in control of your money should include controlling who sees what you do with it.

250
00:20:54.827 --> 00:20:55.868
Zcash fixes this.

251
00:20:56.128 --> 00:21:00.532
Zcash is private digital money with privacy enforced by zero knowledge cryptography.

252
00:21:00.712 --> 00:21:05.614
Zcash-yielded transactions let you send and spend without publicly revealing who you're paying or how much.

253
00:21:05.814 --> 00:21:08.015
When it comes to privacy, there is no second best.

254
00:21:08.175 --> 00:21:13.157
Get started with Zcash using Visor, the wallet Zcash devs and enthusiasts use to encrypt their money.

255
00:21:13.317 --> 00:21:18.679
Zcash wallets are non-trivial, and Visor goes the extra mile to make sure your money and privacy are fully protected.

256
00:21:18.879 --> 00:21:21.140
Open source, self-custodial, fully private.

257
00:21:21.320 --> 00:21:24.301
Use the link in the show notes to download Visor on mobile or desktop.

258
00:21:24.441 --> 00:21:25.142
Protect your future.

259
00:21:25.422 --> 00:21:26.162
Use Zcash.

260
00:21:26.422 --> 00:21:31.425
What are the second order consequences do you think might be coming to the crypto industry?

261
00:21:31.465 --> 00:21:43.632
I know this isn't an FTX implosion where there was fraud, but nonetheless, when something of this magnitude happens, I'm kind of just worried about the blowback on the industry, the increased regulation pressure.

262
00:21:44.152 --> 00:21:52.317
I'm sure entities like the FBI are just not happy with crypto because as a result of crypto, North Korea keeps on ending up with billions of dollars.

263
00:21:52.417 --> 00:21:53.538
You know, it's interesting.

264
00:21:53.578 --> 00:21:54.839
Yeah, it's a great question.

265
00:21:54.959 --> 00:21:56.720
And like, I think they're like, I've been asked that today.

266
00:21:56.760 --> 00:22:10.109
And I've been trying to sort of think it through because I do think this is different, like you said, than an FTX or even a situation where you're seeing sanctions evasion at scale or some other type of activity that, you know, skeptics can sort of point to as a reason.

267
00:22:10.409 --> 00:22:15.092
I mean, when I think about the Genius Act, right, it essentially codifies exactly what happened.

268
00:22:16.313 --> 00:22:17.334
yesterday evening.

269
00:22:18.055 --> 00:22:34.731
It envisions through regulation and legislation, stablecoin issuers having to do compliance to include freeze, seize, burn their native token when it's used for illicit purposes.

270
00:22:35.672 --> 00:22:38.915
This is an amazing example of that happening, the best ever.

271
00:22:39.736 --> 00:22:43.484
Sadly, like there's also half of these funds you're not able to do that with.

272
00:22:43.985 --> 00:22:50.419
But the reality is, I think that this is like, to me, this is the compliance and law enforcement and national security provisions of genius at work.

273
00:22:51.222 --> 00:22:58.547
So I think that that's like an important lesson that I've been trying to hammer home because obviously everyone's focused on the hack and North Korea as they should be.

274
00:22:58.887 --> 00:23:05.631
But this is an amazing story to me for the industry, particularly around Tether and Circle and the amazing work they did.

275
00:23:06.131 --> 00:23:11.115
I was heartened to see Coinbase come out last night very much in support of Binance.

276
00:23:11.215 --> 00:23:11.715
How can we help?

277
00:23:11.755 --> 00:23:14.397
I mean, these are two huge competitors that have fought it out over the years.

278
00:23:14.757 --> 00:23:19.420
But to come together in a moment like that for this community, I think says a lot about what we're building.

279
00:23:20.600 --> 00:23:22.922
Another important piece, I mentioned the Beacon Network, right?

280
00:23:23.182 --> 00:23:29.265
The Clarity Act, rest in peace, I guess, codifies the Beacon Network.

281
00:23:29.785 --> 00:23:37.409
There's an entire section on certifying networks that information sharing, interdiction, disruption, etc.

282
00:23:38.353 --> 00:23:43.175
So I think lawmakers for a long time have been thinking about like, what do we do in reaction to this?

283
00:23:44.716 --> 00:23:56.242
You know, I spent time with a law enforcement agency this week who couldn't have been more bullish on the way they're able to track and trace the flow of funds in ways they never could before.

284
00:23:56.662 --> 00:24:05.746
Quite frankly, worried that somehow they will lose connectivity to this industry or the industry will be hurt in some way where we'll lose the ability to use...

285
00:24:07.712 --> 00:24:11.514
you know, these capabilities to track and trace funds, a U.S. federal law enforcement agency.

286
00:24:11.915 --> 00:24:15.717
So I say that to say that, like, will there be blowback?

287
00:24:15.737 --> 00:24:19.259
Like, yes, and there should be from a cybersecurity perspective.

288
00:24:19.299 --> 00:24:21.680
Like, we really, really need best practices.

289
00:24:22.861 --> 00:24:24.542
You know, I think DeFi has really learned that.

290
00:24:24.562 --> 00:24:27.784
I know the DeFi Education Fund, I met with them recently, are doing some really great work.

291
00:24:28.324 --> 00:24:44.068
you know, in the wake of Kelp and Drift, I think this probably calls for, you know, maybe Binance is the right place given that they're the largest, you know, crypto business in the world by magnitudes to kind of bring together the community to harden cybersecurity.

292
00:24:44.508 --> 00:24:46.088
So I think it's really a mix of things.

293
00:24:46.108 --> 00:24:49.049
But honestly, I think a lot of what we need, we have.

294
00:24:50.769 --> 00:24:53.470
We just got to stop these types of events from happening.

295
00:24:53.830 --> 00:25:06.957
One big concern that's kind of plaguing the crypto industry is that the rise of AI capacity to exploit vulnerabilities in software is as high as it's ever been and will only get higher from here.

296
00:25:07.548 --> 00:25:12.471
I don't know if this hack of Binance really is that same story.

297
00:25:13.091 --> 00:25:23.538
This seems, as you kind of alluded to, a little bit more of the classical Lazarus group strategy, which is social engineering of an internal Binance piece of hardware, a laptop with private keys on it.

298
00:25:23.978 --> 00:25:28.821
Is there an AI story here or is this more of just the classical Lazarus exploit story?

299
00:25:29.381 --> 00:25:31.382
We don't know yet is the short answer to it.

300
00:25:31.482 --> 00:25:45.988
But I think the sort of longer answer is we have seen North Korea really lean into AI, both open and frontier models, in order to, you know, do some of that social engineering up front.

301
00:25:46.008 --> 00:25:50.910
We've also seen them use it in that just pure sort of tech cyber space, the exploit space.

302
00:25:51.311 --> 00:25:54.032
So I think that one, we don't know, I've definitely not

303
00:25:55.121 --> 00:25:58.504
connected and our team is not necessarily connected AI to this specific hack.

304
00:25:58.844 --> 00:26:02.547
But I definitely think we've seen North Korea start to figure out how to use AI at scale.

305
00:26:03.147 --> 00:26:05.789
And obviously, that's like a huge focus for us at TRM.

306
00:26:05.809 --> 00:26:08.051
I think we spent some time in our last conversation on that.

307
00:26:08.451 --> 00:26:12.815
But what we're really trying to do now is use AI to combine on-chain

308
00:26:13.495 --> 00:26:38.320
and off-chain insights into sort of build a holistic picture of risk um which i think is very apropos here in that um we see all the on-chain activity but now we're going to need to understand hey where are these funds going are these shell companies are these otc brokers who's sort of moving these funds and kind of build out that entire picture but i would say that like uh that was a long wind of saying i'm not sure but if i if i had to um

309
00:26:39.045 --> 00:26:48.363
You know, if I had to bet, I believe it was probably used in some way, you know, here, if nothing else, to work sort of on the exploit piece.

310
00:26:49.572 --> 00:26:55.277
Maybe another way to say what you're saying is like, even if the answer is no, we should prepare as if the answer is yes.

311
00:26:55.517 --> 00:26:56.177
A hundred percent.

312
00:26:56.217 --> 00:27:04.044
I mean, like what we've seen over the last right September, October, is this just increasing spike in cyber activity.

313
00:27:04.784 --> 00:27:07.767
And, you know, if you ask me what keeps me up at night, it's that right.

314
00:27:07.807 --> 00:27:14.392
It's hey, if we saw seventy five hundred ransomware attacks last year, now we don't need humans anymore.

315
00:27:14.452 --> 00:27:17.314
We don't need affiliates.

316
00:27:17.354 --> 00:27:19.436
We can have agentic affiliates.

317
00:27:19.576 --> 00:27:22.278
Why isn't that 75,000 or 7.5 million?

318
00:27:22.438 --> 00:27:24.379
And that's a civilization level threat.

319
00:27:24.800 --> 00:27:31.925
When North Korea has that level of capability to take down entire hospital systems, entire giant exchanges.

320
00:27:31.965 --> 00:27:36.708
So I think that whether it was used or not, it's absolutely something that

321
00:27:37.549 --> 00:27:37.889
I don't know.

322
00:27:39.171 --> 00:27:42.954
I will likely spend the rest of my career working on, you know, to be sure.

323
00:27:43.215 --> 00:27:43.395
Yeah.

324
00:27:43.575 --> 00:27:47.359
What does the industry need to do in reaction to this?

325
00:27:47.919 --> 00:27:54.966
How should the industry adapt or change what we do, how we do it in order to mitigate future instances like this?

326
00:27:55.607 --> 00:27:58.828
You know, look, I think it's an offense-defense type of game here.

327
00:27:58.968 --> 00:28:07.172
And I think it's in part, we really, as a community, from the smallest DeFi protocol up to the Binances of the world, really lean into cybersecurity.

328
00:28:08.493 --> 00:28:16.116
You know, look, like, while we couldn't have recovered funds as fast from a bank, no one could walk into a bank and steal $6 billion either.

329
00:28:16.196 --> 00:28:20.178
So I think that, like, we got to figure out how do we really, really

330
00:28:20.878 --> 00:28:23.800
um, safeguard the funds that are, that are on our platforms.

331
00:28:24.260 --> 00:28:26.521
Um, and part of that is getting to the bottom of how exactly this happened.

332
00:28:26.541 --> 00:28:28.342
And I'm sure that will happen over the next few days.

333
00:28:29.063 --> 00:28:31.484
Um, I think then it's this offensive piece, right?

334
00:28:31.544 --> 00:28:35.686
Like, Hey, if this, this is a nation state actor, right?

335
00:28:35.706 --> 00:28:37.787
This is not a criminal per se.

336
00:28:37.827 --> 00:28:38.748
This is a criminal state.

337
00:28:39.468 --> 00:28:45.291
So we need to use every national security, um, tool at our disposal.

338
00:28:45.351 --> 00:28:49.714
So sanctions, um, you know, potential indictments, uh,

339
00:28:50.334 --> 00:28:55.595
offensive cyber activity, you know, the whole gamut of national security tools.

340
00:28:56.556 --> 00:29:01.297
As I said, you know, Patriot Act subpoenas, whatever it takes on the offensive side.

341
00:29:01.397 --> 00:29:04.578
And finally, I think the community is going to continue to come together.

342
00:29:05.258 --> 00:29:06.558
I think Beacon is a great example.

343
00:29:06.758 --> 00:29:08.839
It was, I was really excited

344
00:29:09.059 --> 00:29:14.520
proud is a hard word on a night like last night, but I was, I just stepped back for a moment and watched my team coming together.

345
00:29:14.580 --> 00:29:18.641
I mean, I joined TRM, we were eight people, uh, we're about 500 today.

346
00:29:18.661 --> 00:29:21.082
Uh, and this company has grown over the last six years.

347
00:29:21.742 --> 00:29:27.123
And, um, the team that I saw come together last night, people who just started, people like Nick who've been there forever.

348
00:29:27.723 --> 00:29:29.243
It was just, it was really heartening.

349
00:29:29.784 --> 00:29:35.345
And then I was simultaneously watching Tether do its thing and Circle do its thing and, um, World Liberty, um,

350
00:29:36.785 --> 00:29:38.426
Ripple.

351
00:29:38.566 --> 00:29:39.746
It was just really extraordinary.

352
00:29:39.966 --> 00:29:44.909
And I think that's in large part what I'll remember from my night last night.

353
00:29:45.249 --> 00:29:46.969
I also ate way too much Halloween candy.

354
00:29:47.730 --> 00:29:50.551
So I'm going to blame North Korea for that as well.

355
00:29:51.331 --> 00:29:52.412
Stress eating some candy.

356
00:29:52.432 --> 00:29:52.872
Yes, definitely.

357
00:29:52.912 --> 00:29:55.153
I'm sure you can take a little bit of the edge off.

358
00:29:55.173 --> 00:29:55.393
Yeah.

359
00:29:55.413 --> 00:29:59.296
Ari, well, I'm glad you have, I'm glad we have you in crypto.

360
00:29:59.697 --> 00:30:00.737
I know it was a tough day.

361
00:30:00.757 --> 00:30:06.502
It's a tough day for the industry, kind of on the four-year anniversary of FTX, more or less.

362
00:30:07.143 --> 00:30:16.871
But there was nonetheless some silver lining, as you kind of described, with the teams and the people that we have in crypto, making sure that we can prevent stuff like this from happening in the future.

363
00:30:16.931 --> 00:30:18.392
I know it's been a very long night.

364
00:30:18.432 --> 00:30:21.755
Thank you for coming on and giving me some of the time of day to answer some of my questions.

365
00:30:22.195 --> 00:30:24.497
I'm sure the Bankless Nation is very appreciative of it.

366
00:30:24.737 --> 00:30:25.298
David, thank you.

367
00:30:25.338 --> 00:30:26.660
And thanks to Bankless Nation.

368
00:30:27.982 --> 00:30:32.027
The important thing is really raising awareness in that last couple of questions around what we could do.

369
00:30:32.308 --> 00:30:34.871
And I'm a big believer that we could do a lot and we could do it together.

370
00:30:34.911 --> 00:30:35.713
So thanks for having me on.

371
00:30:36.634 --> 00:30:36.854
All right.

372
00:30:36.894 --> 00:30:37.094
All right.

373
00:30:37.114 --> 00:30:37.575
Get some rest.

374
00:30:37.856 --> 00:30:38.016
Yep.

375
00:30:38.276 --> 00:30:38.657
Thanks, buddy.