Host: What looks like the largest crypto theft on record happened overnight. Binance says about $6.3 billion was affected and about $3 billion has been frozen so far. Binance says no private keys were leaked, yet an attacker still found a way to submit withdrawals. Joining me on Zoom is Christopher Smith, Founder and CEO of Quantus. What do you make of how this happened?
Christopher Smith: These are machines people build to run an exchange managing billions of dollars. They are very complex. We are smart enough to build them, but nobody can hold it all in their head at once, so we are having to adapt to a new environment where AI is used to both attack and defend this software. It looks like it came down to one developer’s laptop being compromised, and it could be related to recent incidents across Web2. Ultimately somebody has to have access to the funds to be able to fix things, so you need some mechanism for that. I think we should be grateful it happened to Binance and not a smaller exchange, because it does look like they will be able to cover all the losses.
Host: Binance says its initial investigation suggests an engineer’s laptop was compromised. Why are people so often the weak point in crypto security?
Christopher Smith: There is an old saying in crypto, not your keys, not your coins, and that is the whole business of custody. People leave their coins on exchanges because holding keys securely is work. The modern software stack is also so complex, with so many layers, that it turns out to be full of holes, and has been for decades. We are having to fix that now because AI makes the cost of finding these flaws much cheaper. Combine that with malicious cybersecurity experts and you have a recipe for disaster.
Host: Can the money stolen from Binance actually be recovered?
Christopher Smith: Stablecoins are effectively digital dollars, so their issuers can freeze, burn and reissue them. That makes them a poor target for hackers unless they can immediately exit into a permissionless coin like Bitcoin or Ethereum. I think about half of the funds were in that category, which limits what Binance will have to pay out. For the Bitcoin and Ether, Binance is just going to have to eat it, and fortunately they have the funds. Sometimes you can trace Bitcoin back to an exchange and use law enforcement, but this was a highly sophisticated attacker who can exit those funds, so it is unlikely anybody will recover them directly.
Host: For viewers who are not technical, what is the difference between a hot wallet and a cold wallet?
Christopher Smith: It is basically whether the wallet is connected to the internet. There is more to it, but that is the most important piece. The hot one is online. In this case it was the withdrawal service, a pool of funds that needs to be available so people can quickly get their money back, so it is natural to keep some funds there. The cold wallet usually holds much more, with higher security and a lot more friction to get in and out. There is no evidence the attacker got anywhere close to the cold wallets. Cold wallets are slow and inconvenient, so there is always a tension between convenience and security.
Host: Binance says no private keys were leaked, yet the attacker still submitted withdrawals. Does the hot versus cold question even apply here?
Christopher Smith: I would say so, though it is a bit of a semantic question. A key does not have to be directly connected to the internet. If there is an automated service that is allowed to submit transactions to the key, which signs them automatically, then the real question is where the friction points are. If it can all be automated, an attacker can just push the button. If a human has to look at it and evaluate it, that slows things down a lot. TradFi has had this idea for a long time. People say Swift is very slow, and it is, but sometimes that is an asset, not a liability.
Host: Beyond this breach, what are the biggest threats facing crypto platforms right now?
Christopher Smith: There is an AI transition under way, and on the other side of this chaos I think there is a more secure software future. In the meantime we are paying back a lot of technical debt. We are discovering that some certificate authorities are not so secure, and finding flaws in PHP and Linux kernels that have been there for decades. It will take time to clean up, and people and organisations need to adapt and move quickly. You do not have time for a committee to argue about minutiae when exploits get dropped on the internet and attackers can use them immediately on anyone who has not updated. Even the idea of warning people about an exploit without revealing it does not work, because AI is so good that if you tell people where the flaw might be, it will find it. It is just going to have to be rip the bandage off. There is no easy way to do this, some people are going to get hurt, so move fast and limit the attack surface.
Host: Is any exchange immune to an attack like this, or can every large platform be a target? Coinbase, for example, posted to reassure people.
Christopher Smith: Some people think that with AI, whoever has the bigger AI wins. It is not exactly like that. Secure software does exist, but in practice there are so many layers that most software is not secure. So it comes down to whether the damage is limited if they lose your money, and whether it is a catastrophic failure or something they can take a hit on and keep moving. Big institutions like Binance and Coinbase have a lot of experience, and this is not the first time they have been attacked. A lot of secure processes are not just about software, and there is only so much North Korea can do without physically entering the premises or locating a physical person. I am optimistic that these attacks are making us stronger, because everybody learns from the mistakes of others and we acquire a kind of herd immunity.
Host: Elon Musk posted that superintelligent AI agents will eventually hack financial systems to obtain money for themselves, not humans. What do you think?
Christopher Smith: Elon is a brilliant guy, and he loves sci-fi and built sci-fi things. But something missing from the AI narrative in general is this: whenever the AI does something scary, who prompted it, and what was the prompt? Open ChatGPT and let it sit there and see if it does anything. You have to prompt it. Could you prompt it in a way that would produce this behaviour? Probably. But I think the appropriate way to reason about legal liability is less about what the AI is thinking or doing, and more about the intention of the person who created and prompted it.
Host: Thank you so much, Christopher, for being with us today.
Christopher Smith: It was a pleasure.
