The Ritual Bitcoin Sacrifices Will Continue Until Security Improves
North Korea has pillaged the Binance cryptocurrency exchange to the tune of $6.3 billion. With results like these, it's no wonder the country's operators have given up on targeting real, actual banks.
In the Oct. 29 heist, tokens from 11 different cryptocurrencies were stolen. This is the largest theft in history, dwarfing the $1.46 billion Bybit hack in February 2025.
Binance was able to get about $2.8 billion worth of the stolen stablecoins frozen, leaving $3.25 billion in currencies that cannot be frozen, mostly in bitcoin and ethereum. Less than $6.3 billion, sure. But still huge. Blockchain analysis companies pretty quickly linked the hack to North Korea, and by the weekend the FBI attributed the hack to a North Korean group it calls TraderTraitor.
Binance's initial incident response reports what it calls a "sophisticated multi-stage campaign." TraderTraitor made its first inroads into Binance in June this year when "engineer A" installed a malicious version of Homebrew after clicking on a malvertising link. Binance's security team detected and cleaned up the malware, but TraderTraitor learned enough about the company's engineering org chart to target them in subsequent operations.
A different Binance engineer, "B," was then lured into a fake job interview in which TraderTraitor used a malicious coding test to install malware on B's computer. This was a two-stage "interview" process, and Binance says that the first round involved a live video interview. The purported human resources representative built trust in this interview by sharing a social media account that included personal photos and videos. It was only in the second interview that B was told to install the malicious coding test. Binance says this entire approach "was more advanced and deceptive than previously seen social engineering approaches."
After compromising B's computer, TraderTraitor "used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C." We assume they mean the engineers' devices, but, come again? This feels like an important part of the "sophisticated multi-stage campaign."
Regardless, this access granted TraderTraitor all the authority it needed to make off with over $6 billion.
Speaking to CoinDesk, Binance founder Changpeng Zhao, who is better known as CZ, said the incident was a "real wake up call, not just for crypto, but for the financial system overall."
"If a crypto exchange can be hacked, banks are in a worse position in my opinion."
On a macro level, this is utter nonsense.
From a narrow security perspective, Zhao is possibly right. Binance says that prior to this hack it had repelled 57 North Korea-linked attempts to compromise its systems in 2026 alone. We suspect a lot of traditional banks would have succumbed to some of those attempts. But then what? Once large amounts of stolen money start moving around the banking system, transactions start being reversed and the attackers evicted.
Back in 2016, North Korean actors stole $1 billion from Bangladesh's central bank. In that attack, the banks that received the stolen money cooperated with Bangladesh Bank to recover around 90 percent of the stolen money. So North Korea got away with only around 10 percent of the stolen value versus around 50 percent for last week's cryptocurrency heist. It's not the susceptibility to hacking that makes North Korea focus on cryptocurrency; it's the ease of moving the money after the fact. That's what makes CZ's statement so ... annoying?
We don't put too much hope in crypto recovery procedures reaching parity with those found in the banking sector. Sure, there are mechanisms such as sanctions that are intended to make laundering cryptocurrency more difficult, but at this point North Korea has a well-oiled, automated cryptocurrency laundering machine.
Which, in a way, is good news for anyone who isn't a crypto investor. Binance and its ilk are acting as a sort of sacrificial cash pile for the mainstream finance world. As long as the crypto world keeps absorbing the financial impact, the financial system writ large should remain safe and stable.
Crypto bros, we thank you for your sacrifice.
I Feel the Need, the Need for Speed
Tech executives everywhere are under immense pressure to speed up the pace of their software development with artificial intelligence (AI). From a security perspective, the results of this faster pace are going to be mixed.
As a case in point, this week 404Media wrote about privacy-focused company Proton’s leadership-led drive to adopt AI. According to the article, an employee's request to security test newly generated code before deploying it was dismissed by CEO Andy Yen as "loser thinking."
"Of course it's possible to be fast and secure," Yen wrote in a Slack message seen by 404Media. "Stop thinking always of how to be slower, and focus more on how to be faster."
It is particularly jarring to hear Proton's management using language that appears to prioritize speed over security. Its first product was the end-to-end encrypted mail service ProtonMail and it has built its reputation on being a privacy and security-focused company.
An internal document obtained by 404Media indicated that the company's rush to incorporate AI was motivated by the need to move faster and keep up with the competition. The company was likely to miss its annual revenue target "due to insufficient velocity" and "by all metrics that matter, we are an underperforming company."
As it turns out, being a privacy and security-focused company doesn't make Proton immune from the laws of commerce. The pressure to adopt AI to move fast to keep up with competitors is being felt everywhere.
Michael Terkowitz, vice president and distinguished engineer for Worldwide Amazon Stores, acknowledged this dynamic in a memo last week that addressed the impact of AI on software development engineering.
Terkowitz said there was an imperative to adopt AI and that "[w]e all need to embrace this change and take the time to learn, or we risk being left behind." At the same time, however, he noted that it was still early days in terms of AI deployment and that "it is difficult to define … what good AI powered engineering practices look like."
So everyone wants to use AI to write code faster, but right now not even Amazon knows how to do that properly.
Once it does zero in on the best way to use AI, we imagine Amazon will be fine from a security perspective. It has existing processes in place to prioritize it and a management structure that means security is taken seriously.
Its security teams report directly to the CEO, and its Security Guardians program parachutes security champions into the company's product teams. An organization with that kind of culture is going to do a good job of safely adopting AI. The fact that it's taking its time to figure out what the best AI-powered engineering practices look like is already a good sign.
Other tech giants are already incorporating AI into their operations to make their products more secure. Earlier this year, Google's Chrome team wrote about how it had incorporated agentic workflows to improve vulnerability discovery, triage, and patching.
So there is the potential for businesses to adopt software workflows that result in a more secure world. We can get behind that.
We also think tech firms should be incentivized to secure their code, perhaps by reinvigorating the U.S. government's Secure by Design initiative. There's probably some room to adjust the extent to which software makers can absolve themselves of all liability in the event of security failures, too.
We think the main lesson here is a simple one, though. The companies that suck at security will continue to suck at security, but faster. And the companies that take this stuff seriously will probably do well.
So if you're looking to AI to make bad software good, you're going to be disappointed.
Three Reasons to Be Cheerful This Week:
- Google dismantles XCPE botnet: Google's Threat Intelligence Group announced that it had dismantled a botnet consisting of more than 1.3 million Android set-top TV boxes with help from industry partners. The group thinks that Videostrong, a certified Android manufacturer, was deliberately adding malware to its devices. The backdoor was used for a number of malicious purposes including ad fraud and as part of a residential proxy network. Google has cut ties with Videostrong.
- Edge blocks malicious site notifications: Microsoft has announced that its Edge browser will block "scareware" notifications from malicious sites. It says that scammers use these notifications to send fake virus warnings and security alerts to users.
- European scam infrastructure disrupted: Europol announced that an international operation had arrested seven suspects allegedly involved in investment scams. Authorities searched 17 locations and seized more than 100 servers. The operation targeted a company suspected of supplying fake websites to criminal groups.
Risky Biz Talks
In our latest "Between Two Nerds" discussion, Tom Uren and The Grugq discuss CISO's expectations and priorities regarding budgets and what they will spend their money on. AI features heavily in 2027 priorities, but what will it deliver?
From Risky Bulletin:
Hackers lock out and extort Li Auto EV owners in Russia: Hackers are taking over the master user accounts of Li Auto smart EV cars sold in Russia, locking owners out of their cars, and extorting them to regain control of their vehicles.
The attacks have been confirmed to a Russian auto news portal by Alexander Rasfairy, the co-founder of a Li Auto car club. Rasfairy says at least 20 owners confirmed hacks, but the number of hijacked cars is likely much larger if considering nonmembers.
Most of the owners who had cars hijacked used Chinese eSIMs provided by the eSender service and by car importers to register the master car accounts.
Game devs are being extorted with AI game-cloning threats: For the past several months, mysterious parties have been sending emails to small game developers and threatening to copy their public demos and unreleased games using AI tools and publish them in advance unless they are paid a ransom demand.
Extortion fees have varied between hundreds and thousands of U.S. dollars.
Some of the extortion emails have made their way online over the past weeks, but the campaign is believed to be the primary reason a large number of game developers started pulling demos from the Steam platform.
Belarusian state hackers get on the data-wiping train: Hackers linked to the Belarusian government have conducted their first-ever destructive data-wiping attack in a major operational escalation.
According to ESET's Q2-Q3 APT activity report, the attack targeted a Ukrainian manufacturing company with an important role in the country's transportation sector.
ESET linked the attack to a group it tracks as FrostyNeighbor but is more commonly known as GhostWriter. The security firm says Belarusian cyber groups have increasingly been helping Russia with its operations in Ukraine.
-(1).jpg?sfvrsn=b4e63999_5)
