TRM Labs：朝鲜黑客60亿美元Bybit被盗及Binance安全响应

All right, Redbird, you are at TRM Labs. TRM Labs, you guys are just on the front lines of any big exchange hack. Let me start with this question here. The day of the Binance exchange hack, this was like a mythological day that never existed, only in our imaginations, but it's finally here. Was this expected? Was a Binance hack kind of expected in your possible futures, or were you surprised to see this? Look, David, thank you for for having me on in in this crazy moment.

Um, if I look scruffier than usual, it's because I uh, as you indicated, I sort of haven't slept all that much in the last 24 hours or so. Um, look, I I think that as hackers have gotten more and more sophisticated, we're seeing higher and higher numbers. If you asked me, you know, a year or so ago, uh, that there'd be a $ 1.5 billion hack on Bybit, I would have said, you know, that's crazy, right? like we're talking about a billion dollars a year by North Korea at the most and then it happened in one day.

Um we've now seen North Korea steal about six 78 billion in the last 6 years or so and then we saw them steal 6 billion yesterday evening. So I mean the threat actors on the other side of these hacks are becoming more and more sophisticated. There's more money within the crypto ecosystem which makes uh you know crypto a target for these types of cyber attacks. And um I know we'll probably get to this later, but AI is really supercharging these types of operations.

So um am I surprised that there's a $6 million hack of Binance? I don't think I'm really surprised about much of anything right right now in this ecosystem.

The uh the news broke about 12 hour a little bit more than 12 hours ago. So like last evening Eastern time, maybe 600 7 8:00 p.m. uh Eastern time. What what have you been doing? Phyllis, put us in the the life of Ari over the last like half of a day.

Yeah, I know it's it's a great question and um you know, I'll tell you I um the I've seen the ecosystem come together in really extraordinary ways and we'll get into the work of Tether and Circle I'm sure in all of this and really beyond. But I was really proud of what happened at TRM, right? I mean immediately uh the team started reaching out to our clients and customers. Um what you know smaller exchanges potentially could be impacted our our partners at reached out to our partners at Binance.

Uh we are a remote first company. So we created a war room uh within Slack where our blockchain intelligence team where our global investigations team was coordinating and then reaching out to our beacon network partners. Um, the Beacon Network is the largest information sharing network within the crypto ecosystem. It accounts for about 85% of all centralized crypto volume. Think Binance, Coinbase, Kraken, OKX, uh, Robin Hood, Stripe, PayPal, um, and 100 global law enforcement agencies all coordinating for a night like last night and um, really kind of being able to leverage those resources uh, allowing us to move really, really quickly.

So, I I would say it was an all hands- on deck uh true war room mentality where I also wanted to make sure that we were getting out information um to the community as we could. So, I was scrambling on the report we ultimately put out last night. Um my colleague Nick Carlson uh who is too humble to to to like when I say stuff like this, I I think is the foremost expert in the world on North Korea and and cryptocurrency.

Um he was um you know talking to everyone he possibly could internally, externally to really coordinate a lot of this this effort. as a result of the effort that you TRM and the Beacon Network put in last night. Is that why money was saved, assets were frozen, user funds were recovered? Can you talk about what what the actual positive results of of all? I I and I I certainly wouldn't take credit for um for for all or any of it.

I I think that like what we did with Beacon is really bring the community together and um essentially the way Beacon works is as funds are moving in real time, law enforcement investigators, private investigators like Zack XPTt and others are flagging illicit proceeds as they're moving in real time and they send out an alert to this network. So the real work that is being done here is like we bring the community together, but it's these investigators who are flagging addresses and it's the exchanges who then are blocking them and working with law enforcement to seize back those funds.

The two biggest players last night um again outside of the beacon network um were were certainly Circle and Tether and what they did was absolutely extraordinary. You know, I I think that like to me if there are two headlines um on this attack, it's one obviously this is the largest bank robbery in human history, you know, by magnitudes. Um you know, I was in this Netflix documentary called The Biggest Heist Ever that was 70 million at the time.

Uh even you know, four 4.2 was recovered in, you know, in the in that in the Bitfinex case, right? This is bigger out the door uh than than we could even imagine. And so this obviously the the number is really important, but to me the response is really the story, right? Like literally Tether and Circle were able to freeze 40% of the stolen funds last night, about 2.4 billion within an hour or so of the hack. Um that really shows the power and promise of what the crypto ecosystem is able to do from a compliance perspective, from a technology perspective, from an investigations perspective.

So, um, I think that the number of the hack is a huge story, but literally, I mean, more was recovered last night than any hack that has actually ever happened. Um, and I think that's a really important story here, too.

I know this just happened. So, we're on like hour 15 16 of this. What's left to settle? Uh, when when you're off of this live stream and you you go back to work, I I believe you haven't slept, so I hope you get some rest in shortly, but like what's left to do? I know like some the the ether is gone, like the Bitcoin is gone, like the permissionless immutable assets, those are just going to be hard to recover. So like what's left to do today and this weekend and next week?

So So I hope you're not entirely right. I I do think it's going to be really hard. It's always becomes harder and harder to recover in that sort of decentralized ecosystem where funds are starting to spread out, starting to move other places where you're using smaller OTC brokers to offramp funds uh to convert funds from from crypto to cash. I can get into that in a moment. Um but the reality is that, you know, between the Beacon Network and just the way that law enforcement works with the exchange community today, I still I still believe that there there's hope.

I mean, just just to give your sort of your your listeners a sense, you know, as this attack happened, we're watching funds flow from Binance, and we put a bunch of graphs in our report last night that that hopefully visualize this, but as you're seeing funds move, what we're what we're doing is we're counting those funds. We're watching them go. We're labeling the addresses where those funds go, and we're watching every dollar move.

So, the hope is not just, hey, you know, obviously stable coin issuers have these really unique capabilities to immediately uh freeze or what I call burn and then ultimately reissue that that asset, right? You're able to actually pull that those funds out of an illicit actor's wallet address and put them into an inaccessible wallet address. It's just extraordinary capability. But for all the other the other funds, the Ether, the Bitcoin, you know, potentially Bitcoin as as we see the laundering process move on, um that becomes much harder. but not impossible.

So as those bad actors are well as North Korea is trying to offramp those funds through exchanges, we need to use the beacon network, we need to just use legal process to try to block and ultimatel