Srsly Risky Biz: The Ritual Bitcoin Sacrifices Will Continue Until Security Improves

Your weekly dose of Seriously Risky Business news is written by Tom Uren and edited by Patrick Gray and Amberleigh Jack. This week’s edition is sponsored by Sublime Security.

You can hear a podcast discussion of this newsletter by searching for “Risky Business News” in your podcatcher or subscribing via this RSS feed.

North Korea has pillaged the Binance cryptocurrency exchange to the tune of USD$6.3 billion. With results like these, it’s no wonder the country’s operators have given up on targeting real, actual banks.

In last Thursday’s heist, tokens from 11 different cryptocurrencies were stolen. This is the largest theft in history, dwarfing the $1.46 billion Bybit hack in February last year. 

Binance was able to get about $2.8 billion worth of the stolen stablecoins frozen, leaving $3.25 billion in currencies that cannot be frozen, mostly in Bitcoin and Ethereum. Less than $6.3 billion, sure. But still huge. Blockchain analysis companies pretty quickly linked the hack to North Korea and by the weekend the FBI attributed the hack to a North Korean group it calls TraderTraitor.  

Binance’s initial incident response reports what it calls a “sophisticated multi-stage campaign”. TraderTraitor made its first inroads into Binance in June this year when “engineer A” installed a malicious version of Homebrew after clicking on a malvertising link. Binance’s security team detected and cleaned up the malware, but TraderTraitor learned enough about the company’s engineering org chart to target them in subsequent operations.

A different Binance engineer, “B”, was then lured into a fake job interview in which TraderTraitor used a malicious coding test to install malware on B’s computer. This was a two-stage ‘interview’ process, and Binance says that the first round involved a live video interview. The purported HR representative built trust in this interview by sharing a social media account that included personal photos and videos. It was only in the second interview that B was told to install the malicious coding test. Binance says this entire approach “was more advanced and deceptive than previously seen social engineering approaches”.

After compromising B’s computer, TraderTraitor “used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C”. We assume they mean the engineers’ devices, but, come again? This feels like an important part of the “sophisticated multi-stage campaign”.

Regardless, this access granted TraderTraitor all the authority it needed to make off with over $6 billion. 

Speaking to CoinDesk, Binance founder Changpeng Zhao, who is better known as CZ, said the incident was a “real wake up call, not just for crypto, but for the financial system overall”. 

“If a crypto exchange can be hacked, banks are in a worse position in my opinion”. 

On a macro level, this is utter nonsense.

From a narrow security perspective, CZ is possibly right? Binance says that prior to this hack it had repelled 57 North Korea-linked attempts to compromise its systems in 2026 alone. We suspect a lot of traditional banks would have succumbed to some of those attempts. But then what? Once large amounts of stolen money start moving around the banking system, transactions start being reversed and the attackers evicted. 

Back in 2016 North Korean actors stole USD$1 billion from Bangladesh’s central bank. In that attack the banks that received the stolen money cooperated with Bangladesh Bank to recover around 90 percent of the stolen money. So North Korea only got away with around 10 percent of the stolen value vs around 50 percent for last week’s cryptocurrency heist. It’s not the susceptibility to hacking that makes North Korea focus on cryptocurrency, it’s the ease of moving the money after the fact. That’s what makes CZ’s statement so… annoying?

We don’t put too much hope in crypto recovery procedures reaching parity with those found in the banking sector. Sure, there are mechanisms such as sanctions that are intended to make laundering cryptocurrency more difficult, but at this point North Korea has a well-oiled, automated cryptocurrency laundering machine. 

Which, in a way, is good news for anyone who isn’t a crypto investor. Binance and its ilk are acting as a sort of sacrificial cash pile for the mainstream finance world. As long as the crypto world keeps absorbing the financial impact, the financial system writ large should remain safe and stable.

Crypto bros, we thank you for your sacrifice.

I Feel the Need, the Need For Speed

Tech executives everywhere are under immense pressure to speed up the pace of their software development with AI. From a security perspective, the results of this faster pace are going to be mixed. 

As a case in point, this week 404Media wrote about privacy-focused company Proton’s leadership-led drive to adopt AI. According to the article, an employee’s request to security test newly generated code before deploying it was dismissed by CEO Andy Yen as “loser thinking”.

“Of course it’s possible to be fast and secure”, Yen wrote in a Slack message seen by 404Media. “Stop thinking always of how to be slower, and focus more on how to be faster.”

It is particularly jarring to hear Proton’s management using language that appears to prioritise speed over security. Its first product was the end-to-end encrypted mail service ProtonMail and it has built its reputation on being a privacy and security-focussed company. 

An internal document obtained by 404Media indicated that the company’s rush to incorporate AI was motivated by the need to move faster and keep up with the competition. The company was likely to miss its annual revenue target “due to insufficient velocity” and “by all metrics that matter, we are an underperforming company”.  

As it turns out, being a privacy and security-focussed company doesn’t make Proton immune from the laws of commerce. The pressure to adopt AI to move fast to keep up with competitors is being felt everywhere. 

Michael Terkowitz, VP and and Distinguished Engineer for Worldwide Amazon Stores, acknowledged this dynamic in a memo last week that addressed the impact of AI on software development engineering. 

Terkowitz said there was an imperative to adopt AI, and that “We all need to embrace this change and take the time to learn, or we risk being left behind”. At the same time, however, he noted that it was still early days in terms of AI deployment and that “it is difficult to define… what good AI powered engineering practices look like”.

So everyone wants to use AI to write code faster, but right now not even Amazon knows how to do that properly. 

Once it does zero in on the best way to use AI, we imagine Amazon will be fine from a security perspective. It has existing processes in place to prioritise it and a management structure that means security is taken seriously. 

Its security teams report directly to the CEO and its Security Guardians program parachuting security champions into the company’s product teams. An organisation with that kind of culture is going to do a good job of safely adopting AI. The fact that it’s taking its time to figure out what the best AI-powered engineering practices look like is already a good sign.

Other tech giants are already incorporating AI into their operations to make their products more secure. Earlier this year Google’s Chrome team wrote about how it had incorporated agentic workflows to improve vulnerability discovery, triage and patching.

So there is the potential for businesses to adopt software workflows that result in a more secure world. We can get behind that.

We also think tech firms should be incentivised to secure their code, perhaps by reinvigorating the US government’s Secure by Design Initiative. There’s probably some room to adjust the extent to which softwaremakers can absolve themselves of all liability in the event of security failures, too. 

We think the main lesson here is a simple one, though. The companies that suck at security will continue to suck at security, but faster. And the companies that take this stuff seriously will probably do well. 

So if you’re looking to AI to make bad software good, you’re going to be disappointed.

Watch Amberleigh Jack and Tom Uren discuss this edition of the newsletter:

Three Reasons to Be Cheerful This Week:

1. Google dismantles XCPE botnet: Google’s Threat Intelligence Group announced that it had dismantled a botnet consisting of more than 1.3 million Android set-top TV boxes with help from industry partners. GTIG thinks that Videostrong, a certified Android manufacturer, was deliberately adding malware to its devices. The backdoor was used for a number of malicious purposes including ad fraud and as part of a residential proxy network. Google has cut ties with Videostrong. 
2. Edge blocks malicious site notifications: Microsoft has announced that its Edge browser will block ‘scareware’ notifications from malicious sites. It says that scammers use these notifications to send fake virus warnings and security alerts to users.  
3. European scam infrastructure disrupted: Europol announced that an international operation had arrested seven suspects allegedly involved in investment scams. Authorities searched 17 locations and seized more than 100 servers. The operation targeted a company suspected of supplying fake websites to criminal groups. 

Sponsor Section

In this Risky Business sponsor interview, Catalin Cimpanu talks with Luke Wescott, Threat Detection Engineer at Sublime Security. Luke goes over the recent rise of calendar-based phishing campaigns over the past year and the reasons behind it.

Risky Biz Talks

You can find the audio edition of this newsletter and other fine podcasts and interviews in the Risky Biz News feed (RSS, iTunes or Spotify).  

In our last “Between Two Nerds” discussion Tom Uren and The Grugq discuss CISO’s expectations and priorities regarding budgets and what they will spend their money on. AI features heavily in 2027 priorities, but what will it deliver?

Or watch it on YouTube!

From Risky Bulletin: 

Hackers lock out and extort Li Auto EV owners in Russia: Hackers are taking over the master user accounts of Li Auto smart EV cars sold in Russia, locking owners out of their cars, and extorting them to regain control of their vehicles.

The attacks have been confirmed to a Russian auto news portal by Alexander Rasfairy, the co-founder of a Li Auto car club. Rasfairy says at least 20 owners confirmed hacks, but the number of hijacked cars is likely much larger if considering non-members.

Most of the owners who had cars hijacked used Chinese eSIMs provided by the eSender service and by car importers to register the master car accounts.

[more on Risky Bulletin]

Game devs are being extorted with AI game-cloning threats: For the past several months, mysterious parties have been sending emails to small game developers and threatening to copy their public demos and unreleased games using AI tools and publish them in advance unless they are paid a ransom demand.

Extortion fees have varied between hundreds and thousands of US dollars.

Some of the extortion emails have made their way online over the past weeks, but the campaign is believed to be the primary reason a large number of game developers started pulling demos from the Steam platform.

[more on Risky Bulletin]

Belarusian state hackers get on the data-wiping train: Hackers linked to the Belarusian government have conducted their first-ever destructive data-wiping attack in a major operational escalation.

According to ESET’s Q2-Q3 APT activity report, the attack  targeted a Ukrainian manufacturing company with an important role in the country’s transportation sector.

ESET linked the attack to a group it tracks as FrostyNeighbor, but is more commonly known as GhostWriter. The security firm says Belarusian cyber groups have increasingly been helping Russia with its operations in Ukraine.

[more on Risky Bulletin]