The Biggest Crypto Heist Ever

Marc Laliberte  0:00  
Hey everyone, Marc here. I am excited to share that we're consolidating all of our threat intelligence and security news content under our new brand, WatchGuard Red Cell. That includes this podcast, which we're renaming Inside the Red Cell. You'll still get all the same great threat content that you've come to expect, but the new brand will tie everything together with the rest of the threat intelligence created from the team formerly known as the WatchGuard Threat Lab. If you're currently subscribed, don't worry; everything will be transferred over. Just don't be surprised when you see the 443 disappear from your feed and inside the red cell pop in. Now, here's this week's episode. Hey everyone, welcome back to the 443 Security Simplified. I'm your host Marc Laliberte, and joining me today is

Corey Nachreiner  0:50  
Corey "all my cryptocurrency is definitely safe", Nachreiner.

Marc Laliberte  0:54  
Do you still have cryptocurrency?

Corey Nachreiner  0:57  
Not really.

Marc Laliberte  0:58  
Heavily invested in Dogecoin or something,

Corey Nachreiner  1:01  
yeah, yeah.

Marc Laliberte  1:02  
Well, I felt it's been what a year and a half, two years since we've talked about cryptocurrency. So on this episode, it is time to talk about cryptocurrency again, and one of the biggest heists, if not the biggest heist ever.

Corey Nachreiner  1:14  
It is like literally.

Marc Laliberte  1:16  
Before we get to that, though, we'll briefly talk about a compromised Claude code extension on the Cursor AI marketplace, and then we'll give a bit of an update on PHP to Shell specifically, with it being weaponized against Palo Alto firewalls in the U.S. and a few other countries.

Corey Nachreiner  1:37  
I guess that's kind of an update to our story last week because there was no proof of a weaponized exploit yet, but this story will change that.

Marc Laliberte  1:44  
We've got the proof. So with that, let's go ahead and PHPR to shell our way in. Yeah, nailed it.

Corey Nachreiner  1:52  
Shells for everyone. Shells for everyone.

Marc Laliberte  2:01  
So before we get into the the PHP to Shell updates and the the massive cryptocurrency heist, the first story that actually popped up on my radar this radar this morning when I first topped online after making my coffee was apparently yesterday evening a malicious version claiming of Claude code, or at least claiming to be Claude code, popped up on the Cursor marketplace. So Cursor is a very popular AI-assisted software development tool. It was kind of the like Claude code before Claude code became a thing. They were one of the first companies to build a fully integrated AI IDE. It's built on top of a fork of Microsoft's VS Code, which is technically an open source IDE tool, but closed source marketplace, which forced Cursor to make its own extension marketplace. On that marketplace, you can get extensions for everything from like reading different types of files and adding linting or testing to them, or integrating with GitHub, or in this case, if you for some reason didn't like Cursor's own integrated AI, you could get the Claude Code extension to add Claude Code's capabilities within your Cursor IDE. Well, on the 29th, so yesterday at the time of this recording, but Thursday last week, by the time you all are listening to it, a new version of a extension claiming to call itself Claude Code, specifically version 2.1 dot 319, popped up on the Cursor Marketplace. Notably, this was not the legitimate Anthropic AI Claude Code extension. It was one pretending to be it, but could have convinced people into installing it.

Corey Nachreiner  3:45  
By the way, I don't know if you you were planning on going into it, Mark. But this what you just said is actually based on updates that I think actually happened today. One of the things I find interesting about this story is the the we're looking at open source malware's research right now, but my understanding is that at first they thought the entry point had to do with VSX and VCode, and there's other researchers that thought other things. So it took them a while to actually get to the point that nope, it actually was the extension right there from the Cursor Marketplace.

Marc Laliberte  4:21  
Exactly. There's some like some things to unpack here. So because Cursor is a fork of Microsoft's VS Code, they can't use the official Microsoft Marketplace. There's a open source marketplace called Open VSX where people can get extensions from, and then on top of that, Cursor has its own marketplace too, where it self-hosts some, I guess, assumingly more official extensions, but obviously not in this case. But Cursor, they announced the the malicious extension, or at least disclosed it, quickly cleaned it up. But for people that downloaded it, it was actually pretty dang nice. So it added 66 lines of malicious code at the very start of the extension before the actual legitimate Anthropic Claude code that they copied over into it would have run. It adds a attacker-controlled SSH key to the user's account on their workstation, tries to turn on the local SSH service, and then it establishes a reverse tunnel to an attacker's IP address 130 4.2 109 dot 82.2 25 of report 8099, which can allow the attacker then to SSH back into the system using that credential they got loaded in, and from there basically do whatever actions they wanted on it. During the initial setup, there was a few other things it did. It went and grabbed information off the host, like its operating system, host name, things like that. Grabbed 40 different environment variables, including ones called key or token or secret or AWS, things that could contain sensitive secret material, and it even set up persistence on the machines, regardless of what operating system it was. It had different methods for macOS or Linux or Windows. And notably, it didn't drop any other additional malware, but it did set up that remote access that the attacker could then use to basically do whatever they wanted, including stealing more data or dropping malware.

Corey Nachreiner  6:21  
By the way, I don't know if you have talking points already for this, so sorry if I'm going too quick. But one of the things interested, we've been talking a lot about these trojanized packages showing up in npm, showing up in PyPy, and I think one of the things we've seen a lot is the Trojanized part often is in things like pre-installer, post-install scripts, and we've given a lot of like you know if if you're being listening to that as a workaround, you might look at those scripts. This happened right at the loading. Like you don't even have to ask Claude to do something with this extension. You you didn't have to. You basically just had to load it and not even use it. That the fact that the 66 bytes of code was right there, that alone was enough. And if you're only looking at the the results of the package and its post-install and pre-install stuff, you might have completely missed this in this particular case.

Marc Laliberte  7:19  
Yeah, exactly. So this was. I mean, it did rely on a little bit of social engineering into people thinking it was the legitimate cloud code extension. It included the legitimate cloud code extension code in there, like it actually did what it was supposed to. So if you didn't notice that reverse tunnel getting set up, and you just started using it, like it would theoretically work. I feel

Corey Nachreiner  7:41  
my understanding is this: if you load, if this extension was installed, it would load not just without a cloud conversation, but without even you trying to use the extension. So, yeah, and it came from their library, so it looked. I mean, it was named officially too. Did actually did it replace the real one of this, or was it literally a Trojanized version of the official one on their own repository?

Marc Laliberte  8:05  
The way that the researchers worded it, it sounded like it was like they took the official extension, slapped in their own code, and then hosted it under a different namespace. So the package name was anthropic dot clog dash code, and the legitimate one is at anthropic dash AI slash Claude dash code. It's like different namespaces.

Corey Nachreiner  8:28  
Gotcha.

Marc Laliberte  8:28  
But like, I could be wrong actually at that point. So either way, like it seemed to have been at least raised a lot of alarm bells. But I think it highlights like a really big weakness that we have, just in software development in general right now. Where Corey, when we started this podcast, man, five years ago, six years ago, very long time ago, probably even longer than that. Some of the things we frequently talked about were like mobile apps, and a lot of the risk around the mobile app marketplace from Android specifically. Apple obviously has its walled garden and was a bit harder to get malicious apps in there, but mobile providers like Android and Apple have done a lot to like really hammer down and add more protections around their marketplace, and it feels like where we're at right now with like VS Code plugins or IDE plugins or Claude plugins, or your AI plugins and extensions, is where we were a decade ago in the mobile app ecosystem, where we're missing a lot of those foundational security protections, and it feels like the wild west.

Corey Nachreiner  9:32  
Yep, totally agree. It's definitely a place that they they need to mature quickly. By the way, I think there were good news. It reminds me a little of the what was the mistake in the xutil? No, there was no mistakes in xutil, but there was a little error in the basically the SSH service enablement. I believe how it how that you know code was written that it would fail on any host where. Cursor wasn't started with admin privileges, and it turns out most cursor installs don't have admin privileges. So it is that that error probably at least limited the exposure of that SSH tunnel on a lot of machines that might have got that. So that was cool. A lucky failure.

Marc Laliberte  10:20  
Just to confirm, actually, it was the legitimate extension on the Cursor Marketplace. What they were saying was the Claude Code NPM package was not compromised. The OpenVSX package and the Microsoft VS Code extension were not compromised. But this was the official, quote unquote, Anthropic one that was compromised.

Corey Nachreiner  10:39  
Yeah, so it is a big deal, and by the way, that is a maybe we'll have an update next week because so far this is just kind of breaking. They don't know how. Like we, the the missing piece of information is how that happened. I didn't know if you're going to get into the proof's existence. Like this very much seems state actor. Don't know for sure, but they're interested. They were smart. This seems like a low and slow type of attack. Like some of the persistence, the the way they hid things is uh before you probably saw a screenshot when Mark was talking about what this did that showed things like the names of the services. But they use names like com dot apple dot sysmonde, which is not an Apple component, but it sure sounds like one. And Sysmon is is usually associated maybe with system internals. So what I'm getting at is all the naming for some of the processes they did. Even the SSH key was SVC telemetry, service telemetry. All of that sounds kind of like I. If any of you run automation and cloud or infrastructure, these are, I'd dare say we have services that has VC something. It all looks kind of normal. It looks like they they hid their channel very well. The fact that they're not loading any malware, even the the kind of the what is it what they were pulling environment variables they weren't actually pulling the values like the variables like key and token and secret and pass of course you would assume okay they don't just want to know that variable they want to know the actual value but they they held back from pulling the values. They pulled the variables, which gives them a lot of information about you know what infrastructure a victim is in, what kind of tools they have. But they haven't actually pulled the trigger on starting to steal stuff. They just opened tunnels. It's like they're they're silently staging all these things that they can grab later, so all of that just made me think this feels very nation-state. This is actually a kind of low and slow as far as the tactics we've seen so far. They obviously have that. They're hoping that SSH backdoor gives them a backdoor, but they're being kind of quiet and smart about it before this was discovered.

Marc Laliberte  13:02  
It's like why can't attackers just name their config files and SSH keys something like "Hi, it's the CCP. Don't look here."

Corey Nachreiner  13:10  
Yeah, yeah, I'm a bad guy. Don't don't stop me. You've been pony.exe stuff like that. It

Marc Laliberte  13:19  
would make it much easier. It's very rude of them to try and fly under the radar like that with legitimate sound

Corey Nachreiner  13:25  
name

Marc Laliberte  13:25  
file names.

Corey Nachreiner  13:27  
Why can't they make it easy for

Marc Laliberte  13:29  
us? The good news is, like, there are some pretty obvious indicators of compromise, like that attempted connection to the 134 address. So, if you are a cursor AI shop and some of your users use the Claude code extension, checking your network telemetry for connections back to that public IP. It would be a strong indicator of whether or not any of your users were affected. Same with some of the the extension version itself, and also the SSH key that gets added to the user's account.

Corey Nachreiner  14:01  
Although speaking of the the the extension installed itself, uninstalling this is not a remediation. That the persistent scripts apparently are standalone. I think besides IOCs published by open source malware and maybe Cursor, Cursor does have a one line check tool that you can use. But just removing this, if you happen to be one of the people downloading in the past 11 hours, does if if you've been infected in some way, it's not enough. So definitely pay attention to how you can check for the additional indicators of compromise.

Marc Laliberte  14:34  
Yep, perfect. So let's move on to the next story, though. Now, which is a bit of an update from what we talked about last week. So, if you remember last week on the podcast, we dove into PHP to shell the internet breaking vulnerability in PHP, which was used by what was it, 68% of all internet services or all websites out there.

Corey Nachreiner  14:57  
Just a few people probably doesn't matter.

Marc Laliberte  15:00  
At the time of our recording, it was very early in the discussion. There was some reports from Amazon AWS from their honeypot service that they were seeing exploits in the wild, rumblings from a few other researchers that they had detected potential exploits in the wild. We were giving hot takes on what was it, ChainGuard, and them unilaterally breaking the responsible disclosure timeline because they claim to have seen exploits in the wild. But as of October 29th, there have been now confirmed exploits in the wild, specifically targeting Palo Alto firewalls deployed in a few different countries. So on October 29th, Dream Research reported a campaign where attackers chained PHP to shell with another Linux kernel privilege escalation vulnerability called Fragnesia to gain root level access on Palo Alto systems that had had management access exposed to the internet. Pausing for a second, reminder for everyone: Don't expose management access to your network infrastructure to the internet. Palo Alto. I

Corey Nachreiner  16:08  
don't know where I saw it, but I think they claim only 0.02% of their users have it exposed. But

Marc Laliberte  16:14  
yeah, Palo Alto learned by now

Corey Nachreiner  16:16  
you shouldn't be in those 0.2%, let alone with any management. Unit 42

Marc Laliberte  16:21  
independently confirmed those attacks, and yeah, in their disclosure, they pointed out that only 0.02% of their global install base has internet-facing management access. So they uncovered this on October 25th when Dream Research found what they called artifacts from a Chinese AI-assisted campaign that rooted 25 servers, including systems in what they called a U.S. government-affiliated environment, and also targeted infrastructure in Japan, Taiwan, and South Korea. But they focused specifically on the three servers in the U.S. government that government-affiliated infrastructure after they gained access to them, according to Dream, the attack surface is the Palo Alto operating system management web service, which also fronts the Global Protect portal. So, might be slightly more exposure than just the management interface. And after rooting the device, most of the attacks went around to try and compromise the Active Directory domains behind these firewalls to steal credentials. Now, there's a couple things that came out of this advisory that were kind of interesting. One of them was they claimed the attackers were using AI-assisted tooling. They actually found some of it in the attacker infrastructure. They said that Claude code was installed. There was an AI-powered offensive security platform that was configured to use DeepSeek and Kimi, which are two open-weight Chinese models. And then there were API keys for a Chinese reconnaissance platform called FOFA. It's kind of like, oh boy, what the heck is it called Census or Shodan, but more catered towards Chinese users? They said the attack started sometime before the 23rd when FOFA, that Chinese reconnaissance platform, identified 19,000 potential targets of exposed Palo Alto management interfaces around the world on october 23 at 1814 UTC, the first U.S. government firewall was rooted, and the configuration was extracted. They noted that the firewall in this case actually crashed as a part of the exploit. Over the next three hours, 24 other targets were rooted. At 1009 on the 24th, so the next day, a second firewall rooted was rooted and became the operational base for this attack attack campaign. A few minutes later, at 1030, a reverse SSH tunnel was established. 15 minutes later, boot surviving persistence was installed on that firewall. About it, 50 minutes later, a internal server behind the firewall was also routed because of PHP to shell through that reverse tunnel. And then 30 minutes later, that Active Directory attack campaign started, where they tried to steal credentials and harvest domain information out of the organization. And then later that day, still in the 24th, they went and cleaned up their tracks to hide some of their forensics, but then left the persistence mechanisms behind. So it seems like a very targeted attack towards specific organizations. They potentially could have gone after 19,000 or at least 5000 that were still online, but once they found these handful of potentially high-value targets, they really focused in on just two firewalls associated with U.S. government adjacent organizations.

Corey Nachreiner  19:49  
If you're watching the video, you can see how each stage basically is filtering and filtering down targets. Yeah,

Marc Laliberte  19:56  
so seems very targeted. I would suspect. Very nation-state backed on this one as well. If you do have a Palo Alto device, make sure you update to the latest version to fix the vulnerabilities. And also, if you own any firewall appliance whatsoever, do not expose management access to the internet. Period.

Corey Nachreiner  20:16  
Yep. By the way, that Fragtasia, whatever that's a pretty. It's an older vulnerability, so it is kind of interesting that it wasn't taken care of for so long.

Marc Laliberte  20:28  
It is an older vulnerability, but I could see why on a like firewall appliance, like a Palo Alto firewall,

Corey Nachreiner  20:36  
expect maybe a kernel only. So let's

Marc Laliberte  20:39  
yeah, maybe a kernel privilege escalation issue would get deprioritized, especially like I'm assuming that they are probably drowning in vulnerabilities found by AI, like every single vendor out there is right now, and I could see why they deprioritize that in favor of focusing on other more exposed vulnerabilities too. But

Corey Nachreiner  21:00  
this is also a great example of low and slow, by the way, because they they kind of did the same thing. I was I mean, the the last story didn't really do as much exploitation and malware as they needed to. But these were also owned and parked in a way for the the 22 of the 24 victims. They there was a web shell, but they just sat at the web shell and didn't go any further. So again, like you said, we already kind of suspect this is Chinese nation state. But more low and slow, getting the device, parking it, doing enough kind of cleanup to see if you can hide and have that APT persistence for a while.

Marc Laliberte  21:39  
And I think now it is clear that PHP to shell is being weaponized out there in the wild, and so if you do have any server infrastructure exposed to the internet running a older version of PHP, it's past time to update it. But it's also

Corey Nachreiner  21:53  
yeah. By the way, as you say, past time to update it. Pragnesia is on CSIS KV list, and apparently there's october 31, so that's tomorrow federal deadline. So if you're in the government, that this kernel LP flaw should be you need to patch it before then and all your stuff.

Marc Laliberte  22:12  
I think like one other takeaway I have from this is like this shows just how scary some of these like vulnerabilities and fundamental building block libraries like PHP can be like thinking back to Log for Shell that vulnerability in Log4j, where it was so difficult to uncover just what everyone's exposure was because like as a systems administrator you don't know what your applications are using under the hood without like a very good vulnerability management process, or an SBOM in this case, and for this, like PHP to Shell, like yeah, you probably know all of your server infrastructure and what web server applications they're running, but without doing some digging, it may not be obvious that your firewall appliance was using PHP under the hood. I mean, quick note for for just real quick, for WatchGuard customers, PHP is not in use in any of our products or services, so no exposure for you guys. But it is a very popular application, so it makes sense why like Palo Alto's firewall would use PHP under the hood.

Corey Nachreiner  23:16  
I did. Let's pause for SBOMs, by the way, with things like CRA coming. I assume our audience knows what S bomb is, but if you haven't heard of it, software bill of materials. Oh,

Marc Laliberte  23:26  
that was like an F bomb.

Corey Nachreiner  23:28  
Yeah, slightly more polite. Can't say the S word. Shucks, shucks, no shucks for us. No shucks, bombs. And obviously, a software bill of materials is just if you do have a product? You're you're providing a list of usually the open source or third party dependencies and things the product has in it. And while I will say WatchGuard still has work, which we are doing by the way, where we're going to be able to provide these to you in in a secure way if you are a customer. So obviously, Mark said we go to PCERT if you're ever curious if we're exposed. Not only will our PCERT page show if we are, but our team does informational posts for this where we say we're not exposed to this, but yet we have an alert for you to tell you that. But in the future, like for your security vendors, when these things happen, big industry-wide ubiquitous component issues, going to vendors and looking in SBOMs is probably your best bet. Besides just asking them directly, so I do think you're going to see a lot of of people start to make SBOM part of their security validation with vendors they're working with.

Marc Laliberte  24:36  
Agreed. So moving on to the next story, Corey. You know what we haven't talked about in a while, and what I up until now forgot even existed still.

Corey Nachreiner  24:47  
NFTs, all this cool art I have that's going to be worth billions, so I can retire.

Marc Laliberte  24:53  
I mean, you joke. Let's throw some stats at it. Board ape yacht clubs value for all their little ape things have crashed 99. Percent in the last couple of years, most of the virtual real estate NFTs, like the Sandbox or Decentraland or Snoopverse, have crashed by over 99% in recent years. It's a shame that no one could have predicted that these things would not actually crash value. But that's I

Corey Nachreiner  25:17  
was being sarcastic, but I bet you NFTs are slightly related to what we're getting to,

Marc Laliberte  25:22  
yeah. As much as NFTs are absolutely cratering right now, things that have actually held relatively steady, with a few pretty major ups and downs that probably ruined a lot of people's days, were traditional cryptocurrencies like Bitcoin or Ethereum or XRP. Exactly. So some of the cryptocurrencies are still worth quite a bit of money and are still obviously being targeted by threat actors and specifically North Korean threat actors, where feel like the majority of their GDP is probably made up with cryptocurrency theft targeting exchanges around the world. And on this last Thursday, on october 29, North Korea's Trader Traitor group carried out them before. I'm pretty sure. Yep, carried out the largest cryptocurrency heist of all time, stealing at the time what was valued around $6.3 billion in cryptocurrency from wallets belonging to the cryptocurrency exchange, Binance. Now, Binance and many of its partners and operators of some of these cryptocurrency funds claim they've frozen roughly half of the stolen funds, but the other half, around 3 billion, are likely gone for good. And there's some interesting details we'll get into around how the attackers were able to evade some of these like fund freezing mechanisms that exist on some of these cryptocurrency blockchains. So possible,

Corey Nachreiner  26:49  
though, man, cryptocurrency is so secure and perfect, and it's the best place to keep your money. This

Marc Laliberte  26:54  
is definitely the finance of the future for sure. That 6.3 billion, though, is roughly double everything that North Korea has stolen to date in terms of cryptocurrency. Just to put it in perspective, there and they've been prolific in their ability to steal cryptocurrency from exchanges and from victims, just random users over the last decade or so. So researchers at TRM published their analysis of the heist and went into some of the details. They noted that the preparation actually started 36 hours before the the theft, where the attackers set up their operator wallets. They proved they could receive funds from them. They sent three small withdrawals through Tornado Cash, which is a cryptocurrency laundering service. Just to put it plainly, early in the morning on the 29th, they deployed their first piece of code for the attack and tested it on two of their wallets. Later that day, they rehearsed the final version on a third wallet, and then four hours after the rehearsal, they deployed some malicious code. In this case, a smart contract to Binance's hot wallets. So in cryptocurrency, there's hot wallets, cold wallets. Hot wallets are connected to the internet. They're used by exchanges or people to send and receive funds, like just normally. Cold wallets are ones where you can receive funds because the keys exist, but that private key is stored offline, usually airgapped on a system with no internet connection. But the hot wallets are think of it like the operating bank account for Binance, where Binance users might send or receive funds from it. So, after deploying that malicious code, the first theft came at 2005 UTC, so roughly 8 o'clock UTC. Over the course of the next four minutes, five Binance wallets set 20 233 million XRP, which I think is what is it, Ripple or is that Monero? I think it's Ripple to a single attacker address, leaving in each wallet only its minimum balance. The Binance wallets on Solana and Optimism followed after at 2010 UTC. At 2020, the Binance Bitcoin hot wallet sent 18,270 Bitcoin to an attacker address. It's a crapload of money. Two minutes later, the Binance hot wallet on Tron sent 612 million USDT, which is a like US dollar pegged cryptocurrency, and 46 million TRX to an attacker controlled wallet. And the really interesting bit was when they went after the Ethereum wallets. So I guess to get a little in the weeds for people that haven't been following cryptocurrency at all, or at least not in a couple of years, Bitcoin operates off of just a traditional transaction ledger where you can send or receive fractional values of Bitcoin to other wallets. Ethereum is much more complex, where it's more of a. Distributed compute system where you can actually use what are called smart contracts, where the the network executes these contracts. Think of it like an application to send and receive funds, or just to do other things. Like Corey and I have some crypto kitties, for example, an application built on top of Ethereum. I guess the precursor to NFTs. Maybe we are part of the problem. Crap! But they can also be used for really complex transactions and trades. And way back in well, way back in 2015, the Ethereum blockchain added a new feature where a wallet could basically delegate its functionality to another smart contract by signing a certain authorization, which then gave that smart contract permissions to go basically do whatever they want with that wallet. Supposed to be used legitimately to like set up delegated wallets for more distributed applications, but obviously this is a pretty high risk type of feature where it could give someone the ability to take over a wallet if they can sign a authorization using that wallet's private key or an associated cryptography key. So on 29th at 2020 UTC, the attacker submitted a single transaction with 50 different authorizations, each of them signed with Binance's hot wallet key, and each pointing to an attacker-controlled smart contract. So 50 different authorizations, all signed with the valid key. So they had access to the signing infrastructure for Binance, but they had to use 50 different authorizations because the authorization had to take into account the the transaction number in order to actually validate and execute.

Marc Laliberte  31:46  
And so, by blasting 50 by the time that this particular request executes, the transaction number was probably somewhere in that 50 authorization transaction range, which allowed it to validate and execute. And so, 3.5 minutes, three and a half minutes after the delegation, the attackers instructed that hot wallet to send its entire balance, 167,000 Ethereum worth $1.6 billion, to an attacker-controlled address. And over the next three minutes, as more Binance users would submit more Ethereum to this wallet is a part of just normally depositing money. This now delegation kept sweeping it out into attacker-controlled wallets. So overall, $6.3 billion worth of cryptocurrency drained over the course of like 20 minutes after a pretty big setup earlier in the day. That is a massive amount of fake money,

Corey Nachreiner  32:44  
but it's not fake if you can cash it out, and if you're a sanctioned country, man. And so

Marc Laliberte  32:52  
it's one of those

Corey Nachreiner  32:53  
where surprise people are still. Anyways, go cryptocurrency.

Marc Laliberte  32:59  
Go cryptocurrency. So the TRM like started theorizing on how could this incident have possibly occurred? Like it's possible they compromised a single wallet. That happens from time to time, even with big crypto exchanges like Binance. But in this specific one, they compromised multiple wallets on multiple different chains using multiple different key types, multiple different signing schemes. Like every cryptocurrency chain operates a little bit differently, and they all have different wallets. And all of them, for all of them, the attackers produced a valid signature all within this half an hour time frame. And so, to put

Corey Nachreiner  33:37  
simply, this is a Binance breach. I mean, we don't have the rules, the the details yet, but this seems a big enough breach to them to get into their signing infrastructure, right? Or,

Marc Laliberte  33:47  
yeah. So the assumption is they gain the ability to make some Binance hot wallets sign transactions. The interesting piece was that batch of just 50 pre-signed authorizations. TRM suggests that that access that means the access might have been limited, or that the the signatures had to be requested through a system only in batches. So they found maybe like an endpoint that they could abuse or attack to go sign. So maybe a breach, but not

Corey Nachreiner  34:15  
a full infrastructure breach. Enough of a breach to get some pretty valuable information, but throttled through something

Marc Laliberte  34:23  
exactly, and so here's where it also gets really crazy, or at least interesting. So for some cryptocurrencies like Bitcoin, and in most cases Ethereum, like once you get that cryptocurrency, it's yours. There's no way for someone to claw it back, and now it's just a matter of you try to launder it as much as you can. So when you eventually cash it out on some other exchange. They can't point it back to you as the the thief for it. But other cryptocurrencies can actually be frozen. It's like some of these U.S. dollar pin cryptocurrencies, like USDT, can actually be frozen by the maintainers of that block. Chain is not. While it's a decentralized cryptocurrency, it is effectively managed by a single entity, and that entity can block access and freeze those coins. But the attackers accounted for that, and so for some of the cryptocurrency they stole on these freezeable assets, they went and abused other decentralized finance features to still get cryptocurrency that they could just run away with free and clear, like for example, there's borrowing applications on different blockchains where you can put up some form of cryptocurrency in order to borrow another form of cryptocurrency. So, for example, they went to one of those decentralized platforms called Ave, and they borrowed almost 20,000 Ethereum against 60 million of USDT cryptocurrency. So they got 20,000 Ethereum. That's now theirs. They can go do whatever they want with it. There's no way to freeze it. The 60 million in USDT that they put up as like collateral for that borrowing is now frozen, and in theory, it's like it's not the attacker's problem. Like they already have the Ethereum; they don't have to pay it back. Yeah, the USDT they put up is frozen. That just means that these two players in the game, Av and whoever manages USDT, they're the ones that are screwed because of that. And they did that with a few other ones too. They spent really the first couple of hours just converting all of their freezeable stablecoins into assets that couldn't be frozen, like Ethereum, so they could run away with them. That proves that they knew exactly what they were doing, which makes sense if it is truly these North Korean-based threat actors. They are probably the most knowledgeable on cryptocurrency and cryptocurrency laundering out of anyone out there.

Corey Nachreiner  36:44  
They they've stolen stuff before and seen it's how it's been frozen, so they now know that they have to work on techniques to get past it.

Marc Laliberte  36:51  
It is. I'm gonna put on my my jerk hat for a little bit, my cynical hat or sarcastic hat, and I still can't believe like there's probably some future where cryptocurrency, like a cryptocurrency or the technology itself, is used widely across like like globally around the world for like everyday type of stuff, not just as one of these. I still consider kind of hobbyist, I guess, at this point, but it's tough for me to say that like our world financial system should rely on something like this when it's so easy to abuse these different tools to launder it, to steal funds in a way that's totally unrecoverable with like absolutely no oversight capability at all. Like that seems like like scary. I've been

Corey Nachreiner  37:41  
on this bandwagon for a while. I think I I know you're on that bandwagon now, but I think you were more pro cryptocurrency. Oh, sure as heck was. I was totally into cryptocurrency as a technology when it first came out of it, but I never really. As soon as the security ramifications came out, and you've heard me talk about fiat current. Like at the end of the day, people say that the positive decentralized part is all about libertarianism, but currency is fake. You know this whole idea of fake money. I believe as much as people might not trust governments or entities, unless you have an overarching organization that does control it. Like talk about stablecoin. Yes, it acts like cryptocurrency, but they actually do have an organization that can freeze it. Unfortunately, when you have a fake currency, you have to trust somebody to try to maintain it. Yes, governments fall apart, and governments fail about that too. But at least governments and banks and businesses seem to do a general better job than the average public and all these private organizations doing it their own way. So, I don't trust cryptocurrency right now. I think digital currency can be a thing, but I think eventually it's going to have to be backed by something that the world trusts. And you know, some of the things libertarian likes have freedoms of doing whatever. All those freedoms really lead to criminal activity. What you're trying to do is not be taxed and hide stuff. And guess what? Maybe you think it's okay for you to do that, but bad guys are doing that too. So I, I don't know I I hope we get a digital currency because the the beauty of being able to use some cryptography to protect money sounds good I hate dealing with cash and it'd be nice to just have easy pay everything with my phone but I I'm not prepared if you're a day trader and you know the risks, but you just want to make your money and leave everyone else to the Ponzi scheme of losing their money. More power to you. Maybe people make money that way, but I'm not going to put my investment in it.

Marc Laliberte  39:51  
Yep, I think there is a future in there somewhere, in some form or another. But this sure ain't it, and it. Current form. Now, to Binance's credit, they said that they're going to cover all user losses using their own, like corporate-backed resources, their own capital reserve. I'm assuming they've got some form of insurance, even though I think in the past they've claimed that they they don't operate insurance on this sort of stuff. But

Corey Nachreiner  40:19  
to insure, I can't. Frankly, it must be super expensive to get insurance on cryptocurrency. I would be surprised with how insurers know how to make profit in actuary tables that anyone would insure cryptocurrency after the repeated. Like this one's huge, but there's been over and over and over. Like, how the heck do you even afford to get cryptocurrency insurance,

Marc Laliberte  40:42  
yep. But they did say they will make all their users whole whole for anyone that did lose money out of this. So hats off to Binance on that. I'm willing to bet by the time we next record an episode, we'll probably get a bit more of a technical debrief on what happened. Typically with these cryptocurrency style or exchange hacks, we do get some details, and this is the biggest one yet. So

Corey Nachreiner  41:04  
they they have to because how would you have trust in them again unless they showed what happened and how they were fixing it?

Marc Laliberte  41:11  
Yeah, but

Corey Nachreiner  41:12  
when when money is involved, trust is even more important. Like you could lose your people could lose their retirements because of this.

Marc Laliberte  41:20  
$6.3 billion. That is bonkers, and that'll probably fund North Korea's missile program for at least the foreseeable future.

Corey Nachreiner  41:31  
Yay! And I don't know, Corey.

Marc Laliberte  41:33  
Any any final takeaways before we end on that happy subject?

Corey Nachreiner  41:37  
No, I think you covered them.

Marc Laliberte  41:39  
Either way, if you are in the cryptocurrency ecosystem, just be mindful of your hot wallets and how much money you store on them. In this case, it Bit Binance. And if you're not in the cryptocurrency ecosystem, maybe stay out for a little bit at least until something more secure comes along. Pay attention. Diversify at the very least. Don't put everything in one place. I have definitely divested out of my what the heck was it called? Snoop Land, Snoopverse real estate holdings. That's for sure. Everyone, thanks again for listening. As always, if you enjoyed today's episode, don't forget to rate, review, and subscribe. If you have any questions on today's topics or suggestions for future episode topics, you can reach up to us on what is it? Blue Sky. I'm at it's mark.me. Corey is at oh he's over there. Oh, it's mirrored. Man, I can never get that right. Sec.Adept. And also we're on Instagram at WatchGuard underscore Technologies. Thanks again for listening, and you will hear from at least me next week while Corey goes off on his grand adventure.