Fintech Insider Podcast by 11:FS
00:01:34 · Kate Moody
[00:01:34] S0: Hello, and welcome to episode 1,114 of Fintech Insider News brought to you by 11:FS, the six time consultancy of the year that works with financial providers big and small to build the next generation of financial services. I'm Kate Moody, customer strategy director here at 11:FS. And today, I've been joined by a brilliant panel of guests who are going to help me unpack the biggest and most interesting stories from fintech and financial services across the past week. We have doctor Clive Summerfield, CEO at FARx, Wincie Wong, founding member at Tech She Can, and James A. Brown, CEO at Leeds Credit Union. Pretty awesome panel, so let's get going. Okay. Our first story comes from Fintechs, but has been covered all over the place. Pretty big news. Binance users withdraw $5,000,000,000 in the wake of hack. Binance customers have withdrawn almost $5,000,000,000 from the crypto exchange following a massive cyber attack last week, which reportedly saw North Korea linked hackers steal $6,300,000,000 in digital assets. The exchange temporarily suspended withdrawals before reopening on Sunday, triggering net outflows of $4,720,000,000 around 2.8% of the assets held on the platform. Binance says withdrawal volumes have since started to stabilize while deposits remain substantial. Hackers who stole a record $6,300,000,000, that's about £4,700,000,000, from Binance used fake job interviews and a compromised internal AI tool the firm has revealed. Pretty crazy numbers. Clive, where do we even where do we even start with this? I mean, what does the scale of this attack tell us about the security challenges that the crypto industry is facing?
00:03:16 · Clive Summerfield, Kate Moody
[00:03:16] S3: Well, it's a it's a very interesting hack because, the one thing you can say is that the cryptography, in this didn't break. It was the people and the process that broke. So crypto concentrates billions behind a handful of privileged engineers and automated approvals. And, you only have to compromise one trusty person, that can access these systems, and you can then move, as you... As we've seen billions in a matter of of twenty minutes or more. And then... And of course, because it's blockchain, of course, there's no recall on those funds. So the real lesson here is that the weakest link is who is allowed to essentially press the button and transfer the funds. It's not a it's not a break of the cryptography, it's actually a break of the people and the process. [00:04:05] S0: And what do you mean? What do you... Is there anything that could have prevented this? Like, do you think, you know, obviously, I appreciate the information is still coming out and we're still learning precisely how it happened, but yeah, I guess, can you maybe help our listeners maybe understand, dig beneath the services a little bit more and understand what actually did happen and could it have been prevented?
00:04:05 · Kate Moody, Clive Summerfield
[00:04:05] S0: And what do you mean? What do you... Is there anything that could have prevented this? Like, do you think, you know, obviously, I appreciate the information is still coming out and we're still learning precisely how it happened, but yeah, I guess, can you maybe help our listeners maybe understand, dig beneath the services a little bit more and understand what actually did happen and could it have been prevented? [00:04:22] S3: Well, yes, it can be prevented. I mean, banks move, these kinds of funds. They've been moving this kind of level of money for decades now. But they've always actually had dual controls and separation of duties. The gap is that, today approvals, check a device, a token, and a login, and they don't actually verify the live human. Now that's fixable. It's a design choice, not a a law of of, of nature as such. So it becomes, understanding the process and the people, which are always the weakest link in these, types of, fraud and, heists for want of a better term, because it's, you've essentially socially engineered the people, to get around, of course, all the, digital cryptography and the firewalls and all the digital security. And this is this is a hallmark of of a whole range of hacks that have been happening over the past couple of years. [00:05:24] S0: Absolutely. Wincie, what was your what was your response to this story? What did... What was the first thing you thought of when you saw the news?
00:05:30 · Wincie Wong
[00:05:30] S4: I mean, I think, Clive touched on a lot of it. It is very much technology that is important, but then it is the people. It's how do you have controls? How do you have separation of access? Who gets to access what? That's incredibly important. And these job interviews or however it was that they got this poor DevOps engineer to download some malware was extremely unfortunate. I spent, you know, over fifteen years in that West, one of the large banks in The UK. And one of the biggest things that we used to see was fraud happening not necessarily with technology, but with people. So the engineering always comes through. People... There are criminals out there who dedicate their entire lives on breaking the psychosis of people working in places like the bank or like at Binance in order to access funds that they shouldn't be. And it is because it's so lucrative and so profitable. I remember when I spent time doing transformation in the call centers, we would get an alert when some... When unknown fraudster was on the move, because they would switch from banks to bank because if they spent all their time on just one bank or one financial institution, they wouldn't get very far very soon. So they would move from there to there to there and find all the vulnerabilities that they could find, to poke. So in a way, the bigger these, crypto ledgers become, I think, the more attractive they become to these types of people who are exactly that, trying to look for ways to get access to funds that they shouldn't be.
00:07:14 · James A. Brown
[00:07:14] S5: Yeah, I mean, I totally agree with what Wincie and Clive have said. It's interesting, isn't it, that when new technology comes into the marketplace, is actually sort of governed by the same rules, especially in the financial services sector like the banks are. You look at buy now, pay later, it's been around for quite some time, but it's only very recently actually that that's been regulated. So I'm not overly shocked that this incident has occurred. Do I think it will be the last? No. And I think Clive and Wincie are spot on that, you know, we as people are fallible. But I think also when you're a CEO of big organisations dealing you know, people's money, you actually have to make provision for that. And I think that's where a lot of organisations are not leaning into the investment in the technology piece as much as they should. So although you could argue technology it's thing, it's the human in the loop that's not making the decision to put the sort of the guardrails in place in order to protect the people, the customers that they actually deal with. So yeah, mean, it's very unfortunate and certainly we wouldn't want to see too many instances of these, but I think, you know, Wincie and Clive are right. You know, we just need to be very mindful that our, you know, as big as these campuses are for the likes of Amazon and Google and Facebook and Meta, whatever else, there's the replication of that somewhere else with bad actors trying to get sort of into their systems. And that's the level of investment that they are willing to put in and spend in order to do what they've just done.
00:08:55 · Wincie Wong
[00:08:55] S4: I just wanted to talk about also what was interesting, I think, in the story is that everyone is talking about how 2.8% of those deposits were being withdrawn. And then, of course, Quickly Binance kind of stopped the ability to withdraw. And this is something that financial institutions that are regulated have been dealing with for many, many years as well. What we're not hearing so much about in the news is the 97.2% who have stayed. And, again, with all financial institutions, it's a combination. It's not necessarily that they have so much trust and belief in Binance that they've stayed. It is because maybe they didn't move fast enough or they're maybe trapped in that ledger and they can't get the Bitcoin out or or whatever other crypto they're holding in Binance into other, depositories. And that probably is also worth noting. So it's almost... They're held a little bit in captivity as well. So it's stickiness of that deposit. I think that's really important. One of the things that has happened over and over and over in financial services in the past are runs on banks, for example. You know, we had savings and loans and everything where we had people running to long queues out the door. I mean, in 2007, I think it was Northern Rock in The UK and, where people were just trying to get their money out into a safe place. But in the end, what actually resolved it is not the not the bank saying, don't worry. We will cover it for you. It is the financial services compensation scheme that actually came in and said, actually, we're an independent regulated, body that will insure your deposit. And that is what kind of steadied that shit. And that will be really interesting to see, I think, in this perspective because Binance has that SAFU situation where they say, you know, we will cover things if something happens and we lose your crypto. But that's probably not... I I don't wanna say not good enough in the long run, but maybe it's not enough of an reassurance to give to their customers, I think, in the in the longer run. There might be some regulation or other bodies coming in to help police that maybe in the future as a response.