JD Durkin: Ido Ben-Natan, co-founder and CEO of Blockaid. Ido, I feel like you and I just did this a couple weeks ago in Vegas. Good to see you again. Thanks for taking the time. So, man, I’ve been really hyped up to talk to you about this story to help me better understand it. What a story. Last week, more than $6.3 billion pulled out of Binance over the course of really just 20 minutes or so, the largest crypto heist on record. Walk us through what happened. And for people wondering, how can hackers possibly walk away with that much money in so few minutes?
Ido Ben-Natan: Yeah. So one quick note is it’s not actually the biggest crypto hack ever. It’s the biggest hack ever. Period, right? This is the largest exploit we’ve ever seen from a financial loss perspective. And ultimately, it happened like every single other hack that we’ve seen similar to this one in this space, where it starts with some sort of compromise of some sort of user device, then lateral movement or pivoting inside of the network to eventually get to a position where the threat actor, which we came to realize was North Korea, and a specific group within North Korea called [unclear: “traitor”].
[unclear: “Traitor”] eventually gets to a position where they’re able to reach the infrastructure and the servers that Binance has in place to actually sign different types of transactions across their hot wallets. And then you could see that the defenses that Binance had in place were actually powerful enough to prevent DPRK from stealing the private keys of this hot wallet. But the threat actor was able to create a carefully crafted transaction to ultimately perform a malicious transaction, to send these funds to them really, really quickly. And so that’s ultimately what happened.
JD Durkin: This same suspected group out of the DPRK, is it the same one that was responsible for the Bybit hack last year? And if so, what does this tell us about essentially state-sponsored attacks on financial institutions?
Ido Ben-Natan: That’s exactly right. And I think it’s no surprise to us that threat actors are financially motivated. They want to make money, and so they go after targeting the largest pots of money that they can. Unsurprisingly, Binance is one of those. And so when they go after these different exchanges, like Bybit in the past, [unclear: “but get more recently”] and of course Binance happening now, we can see that these actors are very, very infatuated with going after these different types of digital assets, but they also go after additional infrastructure as well.
JD Durkin: So help me better understand this, because I had this note from our producers: your system flagged all this within really just a matter of minutes, within 2 or 3 minutes. What did your AI models actually see, and what did you learn about the ways the attack itself was actually carried out on Thursday?
Ido Ben-Natan: Yeah. So we scan every single transaction across every single blockchain, not just the ones from our customers. And so Blockaid basically deploys these advanced AI models. We look at these transactions, and we were able to see exactly these types of malicious transactions starting to emanate from Binance wallets, eventually triggering our team and then having us go and react and respond and work with the ecosystem to actually freeze north of $3 billion or so.
Now, the unfortunate part is that we weren’t [unclear: “in line in those transactions”] to prevent them from happening, but we were able to detect them in real time and inform our customers and inform the ecosystem and work with other parties to start to try to capture and contain this disaster.
JD Durkin: Ido, I only got about 40 seconds left. What do we learn from this, and how do we better prevent the next one?
Ido Ben-Natan: Yeah, I think what we learned from this is that there can always be a bigger hack, right? We thought $1 billion was massive. This is four times larger. And God, I hope the next hack isn’t four times larger than this one. And I think the other part that we can learn from this is you can improve these types of defenses, right? Threat actors were not able to steal these private keys. They were able to execute malicious transactions. Next time, we have to make sure they’re not able to execute those malicious transactions and have them target different infrastructure, hopefully a smaller pot.
JD Durkin: Ido Ben-Natan, co-founder and CEO of Blockaid. I’m always grateful for your time, and I always get smarter whenever you and I do these interviews. Really thankful for you for stopping by the show today. Take good care.
Ido Ben-Natan: Likewise. Thanks so much.
