Fintech Insider Podcast by 11:FS
00:00:04 · Kate Moody, S1, S2
[00:00:04] S0: This is Fintech Insider News. This week, Binance users withdraw $5,000,000,000 in wake of HACC. Mastercard partners with OpenAI on Agent Pay and AI transformation, and Revolut secures landmark New Zealand banking license. We'll be tackling all of this and more on today's news show, so don't go anywhere. Ad[00:00:28] S1: This episode is brought to you by Google Chrome. You think you know a browser, but Gemini in Chrome? That's new. It can help you with practically anything on the web, like restoring a vintage motorcycle from a 50 page restoration block or finally break down that long article you've had open for weeks, Gemini and Chrome is here for it. Ready to make anything online make sense? There's no place like Chrome. Check responses, setup required, compatibility, and availability varies 18 plus. Ad[00:00:53] S2: When you spend enough time around great companies, you notice that the best ones treat trust as a growth strategy, not a box to check. Vanta helps companies build and prove trust from day one. Its agentic trust platform connects compliance, risk, and trust at enterprise scale. Vanta delivers a 526% return on investment over three years and pays for itself in just three months. Learn why over 16,000 of the fastest growing companies use Vanta at vanta.com.
00:01:34 · Kate Moody
[00:01:34] S0: Hello, and welcome to episode 1,114 of Fintech Insider News brought to you by 11:FS, the six time consultancy of the year that works with financial providers big and small to build the next generation of financial services. I'm Kate Moody, customer strategy director here at 11:FS. And today, I've been joined by a brilliant panel of guests who are going to help me unpack the biggest and most interesting stories from fintech and financial services across the past week. We have doctor Clive Summerfield, CEO at FARx, Wincie Wong, founding member at Tech She Can, and James A. Brown, CEO at Leeds Credit Union. Pretty awesome panel, so let's get going. Okay. Our first story comes from Fintechs, but has been covered all over the place. Pretty big news. Binance users withdraw $5,000,000,000 in the wake of hack. Binance customers have withdrawn almost $5,000,000,000 from the crypto exchange following a massive cyber attack last week, which reportedly saw North Korea linked hackers steal $6,300,000,000 in digital assets. The exchange temporarily suspended withdrawals before reopening on Sunday, triggering net outflows of $4,720,000,000 around 2.8% of the assets held on the platform. Binance says withdrawal volumes have since started to stabilize while deposits remain substantial. Hackers who stole a record $6,300,000,000, that's about £4,700,000,000, from Binance used fake job interviews and a compromised internal AI tool the firm has revealed. Pretty crazy numbers. Clive, where do we even where do we even start with this? I mean, what does the scale of this attack tell us about the security challenges that the crypto industry is facing?
00:03:16 · Clive Summerfield, Kate Moody
[00:03:16] S3: Well, it's a it's a very interesting hack because, the one thing you can say is that the cryptography, in this didn't break. It was the people and the process that broke. So crypto concentrates billions behind a handful of privileged engineers and automated approvals. And, you only have to compromise one trusty person, that can access these systems, and you can then move, as you... As we've seen billions in a matter of of twenty minutes or more. And then... And of course, because it's blockchain, of course, there's no recall on those funds. So the real lesson here is that the weakest link is who is allowed to essentially press the button and transfer the funds. It's not a it's not a break of the cryptography, it's actually a break of the people and the process. [00:04:05] S0: And what do you mean? What do you... Is there anything that could have prevented this? Like, do you think, you know, obviously, I appreciate the information is still coming out and we're still learning precisely how it happened, but yeah, I guess, can you maybe help our listeners maybe understand, dig beneath the services a little bit more and understand what actually did happen and could it have been prevented?
00:04:05 · Kate Moody, Clive Summerfield
[00:04:05] S0: And what do you mean? What do you... Is there anything that could have prevented this? Like, do you think, you know, obviously, I appreciate the information is still coming out and we're still learning precisely how it happened, but yeah, I guess, can you maybe help our listeners maybe understand, dig beneath the services a little bit more and understand what actually did happen and could it have been prevented? [00:04:22] S3: Well, yes, it can be prevented. I mean, banks move, these kinds of funds. They've been moving this kind of level of money for decades now. But they've always actually had dual controls and separation of duties. The gap is that, today approvals, check a device, a token, and a login, and they don't actually verify the live human. Now that's fixable. It's a design choice, not a a law of of, of nature as such. So it becomes, understanding the process and the people, which are always the weakest link in these, types of, fraud and, heists for want of a better term, because it's, you've essentially socially engineered the people, to get around, of course, all the, digital cryptography and the firewalls and all the digital security. And this is this is a hallmark of of a whole range of hacks that have been happening over the past couple of years. [00:05:24] S0: Absolutely. Wincie, what was your what was your response to this story? What did... What was the first thing you thought of when you saw the news?
00:05:30 · Wincie Wong
[00:05:30] S4: I mean, I think, Clive touched on a lot of it. It is very much technology that is important, but then it is the people. It's how do you have controls? How do you have separation of access? Who gets to access what? That's incredibly important. And these job interviews or however it was that they got this poor DevOps engineer to download some malware was extremely unfortunate. I spent, you know, over fifteen years in that West, one of the large banks in The UK. And one of the biggest things that we used to see was fraud happening not necessarily with technology, but with people. So the engineering always comes through. People... There are criminals out there who dedicate their entire lives on breaking the psychosis of people working in places like the bank or like at Binance in order to access funds that they shouldn't be. And it is because it's so lucrative and so profitable. I remember when I spent time doing transformation in the call centers, we would get an alert when some... When unknown fraudster was on the move, because they would switch from banks to bank because if they spent all their time on just one bank or one financial institution, they wouldn't get very far very soon. So they would move from there to there to there and find all the vulnerabilities that they could find, to poke. So in a way, the bigger these, crypto ledgers become, I think, the more attractive they become to these types of people who are exactly that, trying to look for ways to get access to funds that they shouldn't be.
00:07:14 · James A. Brown
[00:07:14] S5: Yeah, I mean, I totally agree with what Wincie and Clive have said. It's interesting, isn't it, that when new technology comes into the marketplace, is actually sort of governed by the same rules, especially in the financial services sector like the banks are. You look at buy now, pay later, it's been around for quite some time, but it's only very recently actually that that's been regulated. So I'm not overly shocked that this incident has occurred. Do I think it will be the last? No. And I think Clive and Wincie are spot on that, you know, we as people are fallible. But I think also when you're a CEO of big organisations dealing you know, people's money, you actually have to make provision for that. And I think that's where a lot of organisations are not leaning into the investment in the technology piece as much as they should. So although you could argue technology it's thing, it's the human in the loop that's not making the decision to put the sort of the guardrails in place in order to protect the people, the customers that they actually deal with. So yeah, mean, it's very unfortunate and certainly we wouldn't want to see too many instances of these, but I think, you know, Wincie and Clive are right. You know, we just need to be very mindful that our, you know, as big as these campuses are for the likes of Amazon and Google and Facebook and Meta, whatever else, there's the replication of that somewhere else with bad actors trying to get sort of into their systems. And that's the level of investment that they are willing to put in and spend in order to do what they've just done.