--:-- All right, Redbird, you are at TRM Labs. TRM Labs, you guys are just on the front lines of any big exchange hack. Let me start with this question here. The day of the Binance exchange hack, this was like a mythological day that never existed, only in our imaginations, but it's finally here. Was this expected? Was a Binance hack kind of expected in your possible futures, or were you surprised to see this? Look, David, thank you for having me on in this crazy moment. If I look scruffier than usual, it's because I, as you indicated, sort of haven't slept all that much in the last 24 hours or so. Look, I think that as hackers have gotten more and more sophisticated, we're seeing higher and higher numbers. If you ask me, you know, a year or or so ago, that there'd be a $1.5 billion hack on Bybit, I would have said, you know, that's crazy, right? Like we're talking about a billion dollars a year by North Korea at the most, and then it happened in one day. We've now seen North Korea steal about six, seven, eight billion in the last six years or so, and then we saw them steal six billion yesterday evening. So, I mean, the threat actors on the other side of these hacks are becoming more and more sophisticated. There's more money within the crypto ecosystem, which makes, you know, crypto a target for these types of cyber attacks. And I know we'll probably get to this later, but AI is really supercharging these types of operations. So am I surprised that there's a $6 million hack of Binance? I don't think I'm really surprised about much of anything right now in this ecosystem. The news broke about 12 hours, a little bit more than 12 hours ago. So like last evening, Eastern time, maybe 6, 7, 8 p.m. Eastern time. What have you been doing? Put us in the life of Ari over the last like half of a day. Yeah, no, it's a great question. And, you know, I'll tell you, I... I've seen the ecosystem come together in really extraordinary ways. And we'll get into the work of Tether and Circle, I'm sure, in all of this and really beyond. But I was really proud of what happened at TRM, right? I mean, immediately, the team started reaching out to our clients and customers. What, you know, smaller exchanges potentially could be impacted. Our partners that reached out to our partners at Binance. We are a remote first company. So we created a war room within Slack. where our blockchain intelligence team, where our global investigations team was coordinating and then reaching out to our Beacon Network partners. The Beacon Network is the largest information sharing network within the crypto ecosystem. It accounts for about 85% of all centralized crypto volume, think Binance, Coinbase, Kraken, OKEx, Robinhood, Stripe, PayPal, and 100 global law enforcement agencies, all coordinating for a night like last night. and really kind of being able to leverage those resources, allowing us to move really, really quickly. So I would say it was an all-hands-on-deck, true war room mentality, where I also wanted to make sure that we were getting out information to the community as we could. So I was scrambling on the report we ultimately put out last night. My colleague, Nick Carlson, who is too humble to like when I say stuff like this, I think is the foremost expert in the world on North Korea and cryptocurrency. talking to everyone he possibly could internally, externally, to really coordinate a lot of this effort. As a result of the effort that you, TRM, and the Beacon Network put in last night, is that why money was saved, assets were frozen, user funds were recovered? Can you talk about what the actual positive results of all that were? Sure, yeah, and I certainly wouldn't take credit for that. for all or any of it. I think that like what we did with Beacon is really bringing the community together. And essentially the way Beacon works is as funds are moving in real time, law enforcement investigators, private investigators like ZachXBT and others are flagging illicit proceeds as they're moving in real time. And they send out an alert to this network. So the real work that is being done here is like we bring the community together But it's these investigators who are flagging addresses and it's the exchanges who then are blocking them and working with law enforcement to seize back those funds. The two biggest players last night, again, outside of the Beacon Network, were certainly Circle and Tether. And what they did was absolutely extraordinary. I think that to me, if there are two headlines on this attack, it's one, obviously, this is the largest bank robbery in human history by magnitudes. I was in this Netflix documentary called The Biggest Heist Ever. That was 70 million at the time. Even 4.2 was recovered in the Bitfinex case, right? This is bigger out the door than we could even imagine. So obviously, the number is really important. But to me, the response is really the story, right? Like literally, Tether and Circle were able to freeze Tether 40% of the stolen funds last night, about $2.4 billion within an hour or so of the hack. That really shows the power and promise of what the crypto ecosystem is able to do from a compliance perspective, from a technology perspective, from an investigations perspective. So I think that the number of the hack is a huge story. But literally, I mean, more was recovered last night than any hack that has actually ever happened. And I think that's a really important story here too. I know this just happened. So we're on like hour 15, 16 of this. What's left to settle? When you're off of this live stream and you go back to work, I believe you haven't slept. So I hope you get some rest in shortly. But like what's left to do? I know like some, the ether is gone. Like the Bitcoin is gone. Like the permissionless immutable assets, those are just going to be hard to recover. So like what's left to do today and this weekend and next week? So I hope you're not entirely right. I do think it's going to be really hard. It's always becomes harder and harder to recover in that sort of decentralized ecosystem where funds are starting to spread out, starting to move other places, where you're using smaller OTC brokers to off-ramp funds, to convert funds from crypto to cash. I can get into that in a moment. But the reality is that, you know, between the Beacon Network and just the way that law enforcement works with the exchange community today, I still believe that there's hope. So just to give your listeners a sense, as this attack happened, we're watching funds flow from Binance. And we put a bunch of graphs in our report last night that hopefully visualize this. But as you're seeing funds move, what we're doing is we're counting those funds, we're watching them go, we're labeling the addresses where those funds go, and we're watching every dollar move. So the hope is not just, hey, you know, obviously stablecoin issuers have these really unique capabilities to immediately freeze or what I call burn and then ultimately reissue that asset, right? You're able to actually pull those funds out of an illicit actor's wallet address and put them into an inaccessible wallet address. It's just extraordinary capability. But for all the other funds, the Ether, the Bitcoin, potentially Bitcoin as we see the laundering process move on, that becomes much harder, but not impossible. So as those bad actors are, well, as North Korea is trying to off-ramp those funds through exchanges, we need to use the Beacon Network. We need to just use legal process to try to block and ultimately seize back those funds. Because the problem here is, right? This recovery effort is absolutely extraordinary. Again, like hats off to Circle and Tether for what they did last night for this ecosystem. But even with those funds out of play, it's still the largest hack ever by about 2X. I mean, so we're talking about a lot of money. And I guess the last point I'd make on this, and we can kind of get into this to the extent it's interesting, is it's North Korea. And, you know, when we talk about a hack or, you know, hackers or, you know, cyber criminals, They're going to use the funds for a lot of different reasons. Some of it is just purely greed. You want to make money, you want to buy cars, you want to buy yachts or whatever it ultimately is, the way Rosal Khan lived in the Bitfinex hack. But when it's North Korea, we're talking about destabilization, we're talking about nuclear weapons ambition, we're talking about really destabilizing the Korean Peninsula and beyond. This is a country with, I think, estimates around a $20 billion economy. I mean, this is a banana republic by all accounts. They stole $6 billion last night. That's a third of their overall economy. I mean, just like let that sit there for a second. That is crazy. So when we're talking about North Korea, to me, it puts an entirely other angle on any type of theft like this. It becomes a global security issue. I know that when there's hacks of this size, we saw this with the Bybit hack. The FBI got involved immediately. What's been the engagement with law enforcement looks like? What role do they play when it comes to hacks like this? Law enforcement plays a really critical role here. And look, I mean, I am a huge believer that between technology and community, you know, tracking and tracing plus building out that beacon network type of collaboration, we can get a lot done, but we don't have legal process, right? So ultimately, an exchange or stablecoin issuer is going to need a subpoena or a search warrant or a seizure warrant in order to actually take those funds. And the funds that we seize back, there's likely going to be a civil forfeiture process, which is going to require court proceedings. So that's when you really need, you know, a Department of Justice or a global prosecutor's office or law enforcement to really get involved. There's, you know, there are limitations, right? Zach XBT is the best in the world or one of the best in the world at tracking and tracing funds, but he can't serve that subpoena on the exchange to ultimately get those underlying records. And that's when you need that sort of real coordination. And that's what you're seeing from law enforcement. for sure. There's this conversation around EIP 7702 and how the actual hack was executed. I know you're not Binance, you're not inside of their internal operations, so you only have so much limited perspective here, but what can you say about how the hack actually was executed and how novel of an exploit that was? Yeah, it's probably the one thing I would mostly stay away from here, only because I know that Binance has come out with some information, which I'm tracking, which honestly, their narrative around, I believe, an engineer whose laptop or computer systems was hacked in order to gain access to those codes, those private keys, is consistent with what we were seeing on chain, the way this sort of exploit happened and the way those funds ultimately left the platform. But I'd probably leave ultimately that to Binance and ultimately figure out what happened over the course of a few days. I mean, if you think through drift and some of the other activity that we saw over the summer, There could be an extraordinary story here of social engineering and how they ultimately gained access. And we'll see how kind of all that played out. One thing I think that's really important and really how we attributed North Korea in the first place is, you know, ultimately we we saw, you know, cash withdrawals about 36 hours ahead of the attack, small tornado cash withdrawals. Yeah. Sorry, small tornado cash withdrawals at least 36 hours ahead. The attack code was tested on two wallets, then rehearsed on a third with test funds routed back to the attacker and only then installed on that Binance hot wallet. So what I think the story is going to ultimately tell is a long term, very deliberate effort to plan, coordinate and breach Binance's cybersecurity systems. This is how I understand when the Lazarus Group identifies a potential attack vector, they kind of set up a dummy exploit and then they exploit it live, like on chain, like they create a fake Binance wallet and then they see if they can actually do it live. Is it possible to see these things come ahead of time based off certain patterns of like, oh, there's a bunch of gas transactions coming out of TornadoCash? Uh, this is what you would expect to see in case of like some actual larger attack coming. Were there any signs that you could reveal ahead of time that this was coming? So, you know, obviously this is that staging and rehearsal pattern that's really become a signature for, um, for North Korea cyber actors. And sure, you know, obviously these are things that we can see on chain, but the reality is, are they really standing out in a way that, you know, you see sort of this, it's, you know, analogies aren't always useful, but in this case, it's like, you know, is an individual acting a certain way that is indicative of, you know, causing a murder or a school shooting or, you know, like it's really easy to Monday morning quarterback what we should or shouldn't have seen. But I think the reality is, yeah, I mean, there's indicia on chain, but there's a lot of activity on chain and really hard to sort of see. But I think that's what we're seeing here. And in large part, you know, you asked me how my night was last night. Probably the most extraordinary moment was about 9, 9.30, 11. maybe 10 o'clock, we were about to put out this report, basically kind of walking through the hack. And right before we did that, my colleague, Nick Carlson, former FBI analyst, again, foremost expert in the world on North Korea, says this was North, he says to me, this was North Korea. And we really started to go through the why. And part of it very much is that staging and rehearsal piece. But we're also connecting addresses that we've seen in other hacks, you know, Drift. In particular, there's a lot of the similar signatures from Bybit, But that but your question is really getting to sort of how we started to really identify and believe with pretty high degree of confidence that that North Korea was involved here. Does North Korea care about being identified? Like if they exploit something and they get the Bitcoin, the Ether, like the bear assets inside of their their wallets. Like, we can't go do something because they have nuclear bombs. And so, like, do they really care about covering their footsteps? Not that much. And I think that's really what's different about North Korea when you look. And part of how we have, I think, carved out signatures over the years for North Korea, right? You know, you think of a painting painting. I think people like Nick and Christian Chesky and others on our global investigations team, they look at this as an art and they're watching how North Korea is operating and see these signatures. But yeah, part of their signature has always been, hey, we're gonna steal as much money as we can We don't really care if we lose some here or there. I mean, they lost a lot last night, but they also made off with arguably, well, what would in and of itself be the largest hack ever by two acts, right? So they care a lot less about, you know, getting caught because no one's going to jail. There's never going to be an extradition. There's likely not going to be a criminal prosecution of any kind. And this is bank robbery for them at the speed of the internet. So I think that's always been sort of a signature for them. It's like, we're going to steal as much as we can, move it as fast as we can, and try to convert it for weapons proliferation and destabilizing activity. Part of what I believe is that we have to make them care more. And, you know, I talked a lot about cyber letters of Mark and this idea of using, you know, the private sector to go after cyber actors. We talk a lot about offensive cyber. When I was a prosecutor myself and Nick, who I've mentioned several times when he was at the FBI and a colleague of mine, Zia Faruqi, who's now a federal judge and others, issued a Patriot Act subpoena on a Chinese bank for records in a North Korea money laundering case. We need to put diplomatic pressure on. on China, in order to act, right? That is still an important trading partner, an important partner for North Korea. So there are things we can do beyond hardened cybersecurity at cryptocurrency exchanges. There are offensive tools we can use. To me, if they're stealing $6 billion, we should do everything we can to ultimately steal it back. So I think to your question, they don't care because no one's going to jail, and they're And it becomes very, very hard to ultimately seize those funds back. But I think there are pressure points that we could put on them that would make them care more. Yeah, it does feel very lame of us in the West on the United States side of things that like North Korea just hacks billions of dollars. And we're just like, well, it's North Korea. I can't do anything about it. How much? more can we do? Like, if you were in charge, if you were in the U.S. government and you were in charge of, like, standing up like a cyber international police division, like, what would you try and do? Sure, well, first of all, look, I am... not in the national security space anymore. I'm not a senior government official. I was a prosecutor for many years and spent time at Treasury. So, but I do believe that our national security apparatus, our Department of War, our intelligence community are doing a lot of this work today. Right. I guess they're just not disclosing it to people like me. Exactly. Or me. But I believe we can, I always believe we can do more, especially in this space. And part of it is just that diplomatic pressure. And to me, like all roads lead to China. You know, one other piece to this, and we saw that in the Bybit hack, is that eventually North Korea turns these stolen funds over to professional money laundering networks. I think we talked about this earlier. a few months ago on the show more generally. But if we haven't seen that here, we're going to see that here, right? North Korea understands that, hey, we can sell these funds, take a percentage and call it a day and let these Chinese organized crime groups try to use their network of OTC brokers and others to convert these funds to cash. We see cartels do the same thing. We see these transnational pig butchering networks do the same thing. But how do we put pressure on the Chinese government to put pressure on organized crime, right? So I think there are levers we can pull. I mentioned a Patriot X subpoena, offensive cyber. There are a lot of levers we can pull to really, really put pressure on this regime. But the reality is that, you know, This is not a Russia. This is not an Iran. This is not a China, right? This is essentially a banana republic, an entirely rogue regime who has never really cared that much about consequences. I've been trading crypto for almost a decade and I've used so many different wallets, exchanges, aggregators, or front ends. And I'm basically always looking for the same thing, just one interface with a deep liquidity across a bunch of chains and assets where I can access markets like perps, earn yield, trade confidentially, and still control all of my funds. And I've never really found it. And I'm just always switching wallets, juggling gas fees, or getting eaten by slippage. But near.com feels fundamentally different to me. I can do anything I want from any chain and keep all of my activity confidential. Crypto, tokenized assets, perps, payments. I can even earn yield confidentially. One account, over 30 chains, confidential by default. It's the way that crypto ought to work. And it's powered by Near, which has moved over $30 billion cross-chain, uses post-quantum signatures, And that's run over five years on mainnet with zero downtime. Near.com is the best way to be on-chain and be in control. Get 20% of your trading fees back on near.com using the bankless link in the show notes, not investment advice. Dollar stable coins taught Latin America how to store value on-chain. RIPIO is taking that same idea and bringing it to the currencies people actually use every day. With wrapped fiat, RIPIO is putting more than a decade of experience powering crypto infrastructure for leading companies across Latin America behind a suite of six local currency stable coins covering Argentina, Brazil, Mexico, Colombia, Chile, and Peru. Each is pegged one-to-one to its local currency and fully backed by reserves held in regulated financial institutions with independent attestations published for each token. But wrapped fiat is not just designed to sit there, it's built to move. The suite is live across 10 EVM chains with liquidity and integrations already spanning platforms like Morpho, Uniswap, and Chainlink. Users can move between local payment rails like Pix and Spey, and matching wrapped fiat one-to-one in real time with zero fees on both on-ramps and off-ramps and no FX conversion. local rails in, on-chain in the middle. And for builders, Ripio offers APIs, webhooks, widgets, and a sandbox just from day one. Start building with wrapped fiat today at platform.rippio.com. Your checking account isn't public, so why should your crypto be? As AI gets more powerful, your privacy gets weaker. Connecting your identity to your financial history on chain or off is the easiest it's ever been and will only get easier from here. Every data breach adds another piece to the puzzle and every public transaction leaves a trail back to you. And when your wealth is visible, you become a target. Money that can be seen can be stolen. Being in control of your money should include controlling who sees what you do with it. Zcash fixes this. Zcash is private digital money with privacy enforced by zero knowledge cryptography. Zcash-yielded transactions let you send and spend without publicly revealing who you're paying or how much. When it comes to privacy, there is no second best. Get started with Zcash using Visor, the wallet Zcash devs and enthusiasts use to encrypt their money. Zcash wallets are non-trivial, and Visor goes the extra mile to make sure your money and privacy are fully protected. Open source, self-custodial, fully private. Use the link in the show notes to download Visor on mobile or desktop. Protect your future. Use Zcash. What are the second order consequences do you think might be coming to the crypto industry? I know this isn't an FTX implosion where there was fraud, but nonetheless, when something of this magnitude happens, I'm kind of just worried about the blowback on the industry, the increased regulation pressure. I'm sure entities like the FBI are just not happy with crypto because as a result of crypto, North Korea keeps on ending up with billions of dollars. You know, it's interesting. Yeah, it's a great question. And like, I think they're like, I've been asked that today. And I've been trying to sort of think it through because I do think this is different, like you said, than an FTX or even a situation where you're seeing sanctions evasion at scale or some other type of activity that, you know, skeptics can sort of point to as a reason. I mean, when I think about the Genius Act, right, it essentially codifies exactly what happened. yesterday evening. It envisions through regulation and legislation, stablecoin issuers having to do compliance to include freeze, seize, burn their native token when it's used for illicit purposes. This is an amazing example of that happening, the best ever. Sadly, like there's also half of these funds you're not able to do that with. But the reality is, I think that this is like, to me, this is the compliance and law enforcement and national security provisions of genius at work. So I think that that's like an important lesson that I've been trying to hammer home because obviously everyone's focused on the hack and North Korea as they should be. But this is an amazing story to me for the industry, particularly around Tether and Circle and the amazing work they did. I was heartened to see Coinbase come out last night very much in support of Binance. How can we help? I mean, these are two huge competitors that have fought it out over the years. But to come together in a moment like that for this community, I think says a lot about what we're building. Another important piece, I mentioned the Beacon Network, right? The Clarity Act, rest in peace, I guess, codifies the Beacon Network. There's an entire section on certifying networks that information sharing, interdiction, disruption, etc. So I think lawmakers for a long time have been thinking about like, what do we do in reaction to this? You know, I spent time with a law enforcement agency this week who couldn't have been more bullish on the way they're able to track and trace the flow of funds in ways they never could before. Quite frankly, worried that somehow they will lose connectivity to this industry or the industry will be hurt in some way where we'll lose the ability to use... you know, these capabilities to track and trace funds, a U.S. federal law enforcement agency. So I say that to say that, like, will there be blowback? Like, yes, and there should be from a cybersecurity perspective. Like, we really, really need best practices. You know, I think DeFi has really learned that. I know the DeFi Education Fund, I met with them recently, are doing some really great work. you know, in the wake of Kelp and Drift, I think this probably calls for, you know, maybe Binance is the right place given that they're the largest, you know, crypto business in the world by magnitudes to kind of bring together the community to harden cybersecurity. So I think it's really a mix of things. But honestly, I think a lot of what we need, we have. We just got to stop these types of events from happening. One big concern that's kind of plaguing the crypto industry is that the rise of AI capacity to exploit vulnerabilities in software is as high as it's ever been and will only get higher from here. I don't know if this hack of Binance really is that same story. This seems, as you kind of alluded to, a little bit more of the classical Lazarus group strategy, which is social engineering of an internal Binance piece of hardware, a laptop with private keys on it. Is there an AI story here or is this more of just the classical Lazarus exploit story? We don't know yet is the short answer to it. But I think the sort of longer answer is we have seen North Korea really lean into AI, both open and frontier models, in order to, you know, do some of that social engineering up front. We've also seen them use it in that just pure sort of tech cyber space, the exploit space. So I think that one, we don't know, I've definitely not connected and our team is not necessarily connected AI to this specific hack. But I definitely think we've seen North Korea start to figure out how to use AI at scale. And obviously, that's like a huge focus for us at TRM. I think we spent some time in our last conversation on that. But what we're really trying to do now is use AI to combine on-chain and off-chain insights into sort of build a holistic picture of risk um which i think is very apropos here in that um we see all the on-chain activity but now we're going to need to understand hey where are these funds going are these shell companies are these otc brokers who's sort of moving these funds and kind of build out that entire picture but i would say that like uh that was a long wind of saying i'm not sure but if i if i had to um You know, if I had to bet, I believe it was probably used in some way, you know, here, if nothing else, to work sort of on the exploit piece. Maybe another way to say what you're saying is like, even if the answer is no, we should prepare as if the answer is yes. A hundred percent. I mean, like what we've seen over the last right September, October, is this just increasing spike in cyber activity. And, you know, if you ask me what keeps me up at night, it's that right. It's hey, if we saw seventy five hundred ransomware attacks last year, now we don't need humans anymore. We don't need affiliates. We can have agentic affiliates. Why isn't that 75,000 or 7.5 million? And that's a civilization level threat. When North Korea has that level of capability to take down entire hospital systems, entire giant exchanges. So I think that whether it was used or not, it's absolutely something that I don't know. I will likely spend the rest of my career working on, you know, to be sure. Yeah. What does the industry need to do in reaction to this? How should the industry adapt or change what we do, how we do it in order to mitigate future instances like this? You know, look, I think it's an offense-defense type of game here. And I think it's in part, we really, as a community, from the smallest DeFi protocol up to the Binances of the world, really lean into cybersecurity. You know, look, like, while we couldn't have recovered funds as fast from a bank, no one could walk into a bank and steal $6 billion either. So I think that, like, we got to figure out how do we really, really um, safeguard the funds that are, that are on our platforms. Um, and part of that is getting to the bottom of how exactly this happened. And I'm sure that will happen over the next few days. Um, I think then it's this offensive piece, right? Like, Hey, if this, this is a nation state actor, right? This is not a criminal per se. This is a criminal state. So we need to use every national security, um, tool at our disposal. So sanctions, um, you know, potential indictments, uh, offensive cyber activity, you know, the whole gamut of national security tools. As I said, you know, Patriot Act subpoenas, whatever it takes on the offensive side. And finally, I think the community is going to continue to come together. I think Beacon is a great example. It was, I was really excited proud is a hard word on a night like last night, but I was, I just stepped back for a moment and watched my team coming together. I mean, I joined TRM, we were eight people, uh, we're about 500 today. Uh, and this company has grown over the last six years. And, um, the team that I saw come together last night, people who just started, people like Nick who've been there forever. It was just, it was really heartening. And then I was simultaneously watching Tether do its thing and Circle do its thing and, um, World Liberty, um, Ripple. It was just really extraordinary. And I think that's in large part what I'll remember from my night last night. I also ate way too much Halloween candy. So I'm going to blame North Korea for that as well. Stress eating some candy. Yes, definitely. I'm sure you can take a little bit of the edge off. Yeah. Ari, well, I'm glad you have, I'm glad we have you in crypto. I know it was a tough day. It's a tough day for the industry, kind of on the four-year anniversary of FTX, more or less. But there was nonetheless some silver lining, as you kind of described, with the teams and the people that we have in crypto, making sure that we can prevent stuff like this from happening in the future. I know it's been a very long night. Thank you for coming on and giving me some of the time of day to answer some of my questions. I'm sure the Bankless Nation is very appreciative of it. David, thank you. And thanks to Bankless Nation. The important thing is really raising awareness in that last couple of questions around what we could do. And I'm a big believer that we could do a lot and we could do it together. So thanks for having me on. All right. All right. Get some rest. Yep. Thanks, buddy.
