How North Korea became a crypto-theft world leader

Manveen Rana (0:01)

From The Times and The Sunday Times, this is The Story. I'm Manveen Rana.

It was the most audacious heist in cyber history. Last Thursday, in the space of 20 minutes, $6.3 billion was stolen from Binance, the world's largest cryptocurrency exchange. And it all began with one laptop.

Ciaran Martin (0:31)

There was a compromise of a developer laptop. That was the entry point into Binance. And the weakness in the way crypto exchanges are sometimes protected means that a single laptop gives you far more access than it would, for example, in a traditional bank.

Manveen Rana (0:50)

That's Ciaran Martin, the former head of the National Cyber Security Centre, and the former head of Cyber Security for GCHQ.

Ciaran Martin (0:58)

So this allowed the attacker to reach what they call a service container and basically submit unauthorized withdrawal transactions.

Manveen Rana (1:07)

So from this point, the hackers could start siphoning off billions of dollars worth of cryptocurrency.

Ciaran Martin (1:15)

Because of the automated way in which these things work, you could do an awful lot in a very short period of time.

Manveen Rana (1:21)

Like all heists in the movies, the clock was ticking. But these hackers clearly knew what they were doing.

Ciaran Martin (1:34)

They did two things. One was they did in excess of $6 billion of unauthorized transactions. Then the really smart thing the hackers did is they laundered it very, very carefully and very effectively in a very short period of time. They dispersed it to different accounts quite quickly. They got it to infrastructure that's quite hard to reach. They even did a bit of borrowing against it. So they put the money that just stolen up as collateral.

Manveen Rana (2:01)

The race was on to steal as much as they could before they were stopped. 20 minutes, $6.3 billion.

Ciaran Martin (2:19)

When hackers essentially steal from crypto exchanges, there are ways of getting it back, which is why you need to be pretty sophisticated to be able to pull it off in a way that allows you to keep most of the money and they've kept more than half of it. So the really sophisticated part is the laundering.

Manveen Rana (2:38)

This wasn't just a group of criminal hackers. These, according to the FBI, were sophisticated operators backed by the North Korean regime. So why is a state stealing money from crypto exchanges? How advanced is their capability with cyber? And what can be done to stop them?

The story today was North Korea behind the Binance hack.

Ciaran Martin (3:16)

People who are listening to this and are concerned about mainstream finance, there's actually a good news story here in that this would never have happened in a NatWest or a big investment bank. If somebody starts moving $6 billion that isn't scheduled to be moved, all sorts of alarm bells go up in financial systems and so forth. They're so strictly regulated, particularly since the great financial crash, even going back for those with long memories or those of us of a certain age. And the UK will remember the collapse of Bearings Bank way back in the last century, where a rogue trader starts to move and hide all sorts of money. It's really, really hard to do that in a bank. It's far too easy to do that through a crypto exchange. One of the things that is noticeable about this is that because of the sheer size of this, it's sometimes being discussed as if it was new.

Actually, since 2016, there have been nearly 40 occasions where more than 100 million US dollars has been stolen from crypto exchanges. Wow.

The number of times that's happened in excess of 100 million from a bank by hacking is zero. So there is something about the way crypto has been built very quickly. The infrastructure is too open, essentially. And basically their permissions are too permissive. And that's why if a hacker gets in, a hacker can do a lot of damage in a very short period of time.

Manveen Rana (4:39)

Ciaran, you worked for the National Cyber Security Centre. You worked for GCHQ.

How sophisticated are the North Koreans at this? I mean, you must have been tracking them for a while. Have they made this a real speciality?

Ciaran Martin (4:55)

There is a man called Dimitri Alperovitch, who founded a company called CrowdStrike, which is one of the biggest cyber security companies in the world. And he's called the North Koreans the most innovative cyber attackers consistently on the planet. And it's partly to do with necessity. So they used to do what you might call politically motivated hacking. But since sanctions have really bitten over the last 10 years or so, they've targeted their cyber attack capabilities on essentially stealing money. So eventually they said, where's the weakest part of the global financial system with the most money? And they've gone for crypto.