Fintech Insider Podcast by 11:FS
00:03:16 · Clive Summerfield, Kate Moody
[00:03:16] S3: Well, it's a it's a very interesting hack because, the one thing you can say is that the cryptography, in this didn't break. It was the people and the process that broke. So crypto concentrates billions behind a handful of privileged engineers and automated approvals. And, you only have to compromise one trusty person, that can access these systems, and you can then move, as you... As we've seen billions in a matter of of twenty minutes or more. And then... And of course, because it's blockchain, of course, there's no recall on those funds. So the real lesson here is that the weakest link is who is allowed to essentially press the button and transfer the funds. It's not a it's not a break of the cryptography, it's actually a break of the people and the process. [00:04:05] S0: And what do you mean? What do you... Is there anything that could have prevented this? Like, do you think, you know, obviously, I appreciate the information is still coming out and we're still learning precisely how it happened, but yeah, I guess, can you maybe help our listeners maybe understand, dig beneath the services a little bit more and understand what actually did happen and could it have been prevented?
00:04:05 · Kate Moody, Clive Summerfield
[00:04:05] S0: And what do you mean? What do you... Is there anything that could have prevented this? Like, do you think, you know, obviously, I appreciate the information is still coming out and we're still learning precisely how it happened, but yeah, I guess, can you maybe help our listeners maybe understand, dig beneath the services a little bit more and understand what actually did happen and could it have been prevented? [00:04:22] S3: Well, yes, it can be prevented. I mean, banks move, these kinds of funds. They've been moving this kind of level of money for decades now. But they've always actually had dual controls and separation of duties. The gap is that, today approvals, check a device, a token, and a login, and they don't actually verify the live human. Now that's fixable. It's a design choice, not a a law of of, of nature as such. So it becomes, understanding the process and the people, which are always the weakest link in these, types of, fraud and, heists for want of a better term, because it's, you've essentially socially engineered the people, to get around, of course, all the, digital cryptography and the firewalls and all the digital security. And this is this is a hallmark of of a whole range of hacks that have been happening over the past couple of years. [00:05:24] S0: Absolutely. Wincie, what was your what was your response to this story? What did... What was the first thing you thought of when you saw the news?
00:05:30 · Wincie Wong
[00:05:30] S4: I mean, I think, Clive touched on a lot of it. It is very much technology that is important, but then it is the people. It's how do you have controls? How do you have separation of access? Who gets to access what? That's incredibly important. And these job interviews or however it was that they got this poor DevOps engineer to download some malware was extremely unfortunate. I spent, you know, over fifteen years in that West, one of the large banks in The UK. And one of the biggest things that we used to see was fraud happening not necessarily with technology, but with people. So the engineering always comes through. People... There are criminals out there who dedicate their entire lives on breaking the psychosis of people working in places like the bank or like at Binance in order to access funds that they shouldn't be. And it is because it's so lucrative and so profitable. I remember when I spent time doing transformation in the call centers, we would get an alert when some... When unknown fraudster was on the move, because they would switch from banks to bank because if they spent all their time on just one bank or one financial institution, they wouldn't get very far very soon. So they would move from there to there to there and find all the vulnerabilities that they could find, to poke. So in a way, the bigger these, crypto ledgers become, I think, the more attractive they become to these types of people who are exactly that, trying to look for ways to get access to funds that they shouldn't be.
00:07:14 · James A. Brown
[00:07:14] S5: Yeah, I mean, I totally agree with what Wincie and Clive have said. It's interesting, isn't it, that when new technology comes into the marketplace, is actually sort of governed by the same rules, especially in the financial services sector like the banks are. You look at buy now, pay later, it's been around for quite some time, but it's only very recently actually that that's been regulated. So I'm not overly shocked that this incident has occurred. Do I think it will be the last? No. And I think Clive and Wincie are spot on that, you know, we as people are fallible. But I think also when you're a CEO of big organisations dealing you know, people's money, you actually have to make provision for that. And I think that's where a lot of organisations are not leaning into the investment in the technology piece as much as they should. So although you could argue technology it's thing, it's the human in the loop that's not making the decision to put the sort of the guardrails in place in order to protect the people, the customers that they actually deal with. So yeah, mean, it's very unfortunate and certainly we wouldn't want to see too many instances of these, but I think, you know, Wincie and Clive are right. You know, we just need to be very mindful that our, you know, as big as these campuses are for the likes of Amazon and Google and Facebook and Meta, whatever else, there's the replication of that somewhere else with bad actors trying to get sort of into their systems. And that's the level of investment that they are willing to put in and spend in order to do what they've just done.
00:08:55 · Wincie Wong
[00:08:55] S4: I just wanted to talk about also what was interesting, I think, in the story is that everyone is talking about how 2.8% of those deposits were being withdrawn. And then, of course, Quickly Binance kind of stopped the ability to withdraw. And this is something that financial institutions that are regulated have been dealing with for many, many years as well. What we're not hearing so much about in the news is the 97.2% who have stayed. And, again, with all financial institutions, it's a combination. It's not necessarily that they have so much trust and belief in Binance that they've stayed. It is because maybe they didn't move fast enough or they're maybe trapped in that ledger and they can't get the Bitcoin out or or whatever other crypto they're holding in Binance into other, depositories. And that probably is also worth noting. So it's almost... They're held a little bit in captivity as well. So it's stickiness of that deposit. I think that's really important. One of the things that has happened over and over and over in financial services in the past are runs on banks, for example. You know, we had savings and loans and everything where we had people running to long queues out the door. I mean, in 2007, I think it was Northern Rock in The UK and, where people were just trying to get their money out into a safe place. But in the end, what actually resolved it is not the not the bank saying, don't worry. We will cover it for you. It is the financial services compensation scheme that actually came in and said, actually, we're an independent regulated, body that will insure your deposit. And that is what kind of steadied that shit. And that will be really interesting to see, I think, in this perspective because Binance has that SAFU situation where they say, you know, we will cover things if something happens and we lose your crypto. But that's probably not... I I don't wanna say not good enough in the long run, but maybe it's not enough of an reassurance to give to their customers, I think, in the in the longer run. There might be some regulation or other bodies coming in to help police that maybe in the future as a response.
00:11:20 · James A. Brown
[00:11:20] S5: Yeah. I mean, if I take us back just for a moment, just let's say pre COVID, you know, the majority of the world was chasing down let's move away from cash, you know, who is going to be the first country in the world to be a cashless society? And then lo and behold, what happened, COVID hits and that conversation disappeared because we were all forced into the digital world, whether we liked it or not. In The UK, you know, there wasn't the abundant use of QR code technology as there is now. And nowadays, it's just we just take it for granted. We get our phone out, we scan it and off we go. But back to my point, do we actually know what we're scanning? Do we know what data we're actually giving away at that point? Do we actually read terms and conditions when we sign up for things? No. So there's lessons, I suppose. So, you know, not necessarily always dwelling on the negative, but let's look to the positive. Will this maybe get organisations to sort of maybe stop and think actually about what they need to do to actually improve their security levels? I would hope that it probably would for some, especially in, you know, the sort of like the financial services sector, but we're talking about crypto just for the moment. And, know, I've seen some great companies coming out of APAC and some great companies coming out of New Zealand. The first thing that they sort of started with, so that main point was how secure is their platform before they then went to the marketplace. And I think we just need to sort of like turn the conversation on its head over slightly.