Kim Jong-un, crypto bros and a $6.3bn heist

0:00This is The Guardian. Today, how North Korea became the world's cyber-hacking superpower. Cash Now More Later from Opendoor gives you cash up front for your home, plus all the profit later. That's no chaos now, no cash left behind later. Skip the showings now, pocket extra profit later. This is so simple now, this is so awesome later. Or sell fast now and pop the champagne later. Cash Now More Later, now available nationwide. Start your offer at opendoor.com slash ACAST. Profits calculated after fees and costs, eligibility and offer price may vary. Open my phone and I see this. In the last few minutes, the latest update is staggering. Biggest hack in history, not in crypto history, the biggest hack in history.

1:13It was 8pm last Thursday when the panic alarms went off across the crypto world. Emergency live stream where Binance has suffered so far a $6 billion hack. Binance, the world's biggest crypto exchange, had been hacked. They are calling it the largest crypto heist of all time. And almost all of it happened within the space of about 20 minutes yesterday. The cryptocurrency revolution promised to take power from the fusty old central banks and put it in the hands of the people. But the hack exposed just how vulnerable it can be. Almost immediately, the finger of blame was pointed squarely in one direction. Analysts said the hack bore all the hallmarks of previous attacks by a North Korean state hacking unit.

2:04But how did one of the poorest and most isolated nations in the world pull off such an audacious heist? And what will they do with the money? My concern, of course, is where this money is going, where that puts their nuclear program, and what the consequences are. I've been worried about it for years, but 6.3 billion is a big number. So that pace is alarming. From The Guardian, I'm Helen Pitt. Today in Focus, Kim Jong-un versus the crypto girls. Kalina Makortov, welcome to Today in Focus. Nice to see you. Thank you very much for having me. So you're The Guardian's banking correspondent. You've had a pretty busy last few days. But take me back to last week. How did you feel? What was your immediate gut reaction when you heard about the Binance hack?

2:53So I woke up on Friday morning preparing to cover some bank results. And I looked at my phone and I honestly, I think I guessed. This is the one that the crypto industry did not want to happen. 6.3 billion, it said, you know, stolen from the biggest crypto exchange in the largest heist in history. I mean, you don't often see those kinds of headlines that early in the morning. Definitely. And I mean, maybe I'm ignorant, but I had never heard of Binance. What do we need to know about them? How big are they? We're talking about the largest crypto exchange in the world. They were founded in 2017. You know, you're talking about almost any cryptocurrency in the world. Ethereum, Bitcoin, even Dogecoin.

3:39And they're processing, I think, about $95 billion worth of transactions per day. About 335 million users. You chose to trade over $27 trillion across spot and futures with us. It's a place, I think, where people have, you know, gravitated since its founding and kind of serves as that hub for most people who want to trade their crypto. Choose crypto. Choose Binance. See, as you said that Binance was set up in 2017 by quite a colorful character, I think, a guy called Changpeng Zhao. I don't know if I got the pronunciation of that correctly. Canadian businessman, also known as CZ. What should we know about him? Yeah, so he is interesting. Born in China, I think moved with his family to Canada at quite

4:32a young age, around 12. Really rose quite quickly, I think, and really, I think hit his stride at the time where crypto was gaining quite public prominence. And now he is the 18th most rich person in the world, according to Forbes, worth about $114 billion last time that I took a look. Okay. But, you know, I think what most people would have perhaps remembered him around is having been investigated as Binance's founder and CEO over money laundering allegations that sent him to jail for four months in 2024. Binance founder CZ sentenced to four months in prison on anti-money laundering charges. Joining us from Morris. That in itself, obviously a huge deal, huge blow to the crypto industry. Then you get Donald Trump back in office and CZ is pardoned.

5:28The White House press secretary, Carolyn Leavitt, said the president issued the pardon because Zhao, as she put it, was prosecuted by the Biden administration in their war on cryptocurrency. So what have the last three months been like for you? Much more freedom. Much more liberated. I was a free man before, but with a felon status. But now I'm a real free man. I'll be it without Trump admitting that he knew who he was. Okay. Which one? Who is that? The founder of Binance. He has an involvement in your own family's crypto business. I don't know him. I don't believe I've ever met him. And so I gave him a pardon at the request of a lot of very good people. And people might be listening to this episode and thinking, oh,

6:09well, I'm glad I don't invest in Bitcoin or Ethereum or any of those coins. But why should we all care about this heist? So I think what's really interesting is we're in this era, even, as someone who covers traditional finance, where crypto assets are starting to even be adopted or accepted, not even so much on the margins anymore by big financial institutions. You have funds run by BlackRock, other large asset management firms that do allow you to have some exposure to these kinds of assets. And you're not only talking about vast sums, but in an industry that kind of prides itself on security, you know, you can see how this ends up being a litmus test for how the rest of the industry starts to operate.

6:58I mean, you saw the stocks fall across crypto assets on Friday. And I think this is going to raise a lot of questions about how people operate in this market going forward. Right. And this heist has been described as the biggest in human history. Is it really? How big does it compare to previous heists? Yeah, so this affected about $6.3 billion worth of crypto. And that's about four times bigger than the last largest heist. That was about $1.5 billion. That was last year on Bybit. And I think one of the stats that I saw that was really interesting is before Bybit then, the record was actually held by Saddam Hussein as he took money out of the central bank before the 2003 Iraq war. So even when we're talking about non-crypto numbers, this is unprecedented.

7:56And I think it's really brought a focus on the kind of money, the kind of wealth, I suppose, that is flowing through these unregulated channels. So I know that investigations are ongoing as to what exactly happened in this case. But from what we know at this point, what actually happened last Thursday? So if we go back to last Thursday around 8 p.m. London time, it quickly became clear that money was being drained out of wallets on the exchange. Five wallets lost about $300 million within minutes. And it soon escalated. And within hours, the hackers had access and control of about $3.3 billion. I'm making this emergency video because we literally just got news right now that Binance could potentially have been hacked.

8:51It is not confirmed. Assets were quickly frozen. Communications were sent out via social media channels. Binance co-founder Chen Pengjiao, he wrote, user funds are safe. It does look like a hack on Binance. I expect all user funds will be fully covered. I think they were really in crisis mode, trying to also reassure customers that their money was safe. And even if it was funneled out, that they were going to cover the losses. And do we have any idea at this point how the hackers did it? So what we know so far, at least what they've said, is that it was an engineer's laptop that was compromised and hacked and was known as the initial point of entry. And they've since said that there were other vulnerabilities that they were able to identify. But I guess, again, to kind of emphasize, you think, oh, it's just a hack. Then we start to

9:50learn that North Korea may have been the main culprit, which seems to have been confirmed by the FBI as well. So then you start thinking, wow, this is not just some people in a back room, but you're talking about geopolitical attacks a back room, but you're talking about geopolitical attacks. And again, when you're talking about an industry that in a sense prides itself or at least attracts a lot of people by being unregulated, that ends up being quite a double-edged sword in this case. Jean Lee, you were the former Pyongyang Bureau Chief for the Associated Press, but most pertinently for this conversation, you were the co-host of an excellent podcast called The Lazarus Heist, which told the story of the very North Korean cyber hackers who are suspected of carrying out

10:43this Binance heist. Welcome back to the show. How did you feel when you heard what had happened last week? Oh gosh, when I heard that it was believed to be 6.3 billion that was attributed to the North Korean hackers, I felt, to be absolutely honest, sick to my stomach because that is a huge number. When we started the Lazarus Heist podcast in 2020, we were amazed that they were able to make off with $81 million and to think that in a matter of just a couple of years, they've been able to accelerate their capacity and their capability with every hack, it just gets bigger and bolder and a bigger yield. For me personally, of course, I think about where that money's going and the difficulty it places on any kind of diplomacy with North Korea because it makes

11:38them stronger, makes it much harder to negotiate with them. And the stakes and the consequences are terrifying. Yeah. In the couple of hours before we started recording, North Korea issued a denial saying they had nothing to do with this heist. They called it absurd rhetoric. Should we pay any heed to their denial, do you think? There are a number of provocations that North Korea has been accused of over the years that they have denied. And I'm thinking particularly in 2010, there was an attack on a South Korean warship in the waters off the Korean coast that clearly two authorities looked like it had the signs of a North Korean attack that they denied. And there's a pattern to how the attacks are carried out. And the FBI

12:27and authorities have been chasing them for a very long time. I always call it a cat and mouse game. North Korea's state-sponsored hackers have got various different nicknames. Trader Trader was the one given to the latest gang, but they are also known as the Lazarus Group. So let's stick with that one for today. Tell me, who are they and when did they come into being? The Lazarus group is a nickname that we give for the North Korean hackers. And part of the reason cybersecurity firms call them the Lazarus group is because, like the biblical character Lazarus, just when you think you've stamped them out or just when you think they've died, they come back from the dead. And in the case of the North

13:05Koreans, they come back stronger. The first awareness I had of activity from North Korean cyber hackers was in 2009. And I was actually in Seoul at the time as the AP Seoul Bureau Chief. And I remember trying to pay for coffee and the machine went down and it was so unusual. Later, we found out that that was a North Korean cyber attack. And that was the first sign. The real flag planting cyber attack. This was back in 2014. There was a movie that Sony Pictures was making called The Interview. Take him out. You want us to kill the leader of North Korea? Yes. And The Interview does depict North Korea and the fictional assassination of Kim Jong-un. You want to go kill Kim Jong-un? Totally. There was this massive attack of Sony Pictures

14:00in which cyber hackers got into their system and divulged not only films that hadn't been released, but also emails from among executives that they would prefer to have kept secret. Last week, Sony Pictures was hacked. The company's email crippled, this image appeared, and then at least five of Sony's films were stolen. Now! From Brad Pitt's movie Fury to films like the yet-to-be-released Annie. That was almost immediately pinned by the U.S. government on the North Korean hackers. President Obama did specifically name North Koreans, and that was when the North Korean hackers really came on the radar in an international sense. A warning tonight from the FBI. It's alerting businesses about a cyber attack that could do serious damage to their computer data.

14:56And we did see them from year to year go from strength to strength with not only larger cyber attacks with each hack, but more diverse and broader in terms of their reach. According to blockchain analytics firm Elliptic, North Korea's Lazarus Group is behind the hack, and at least 10% of the stolen crypto has already been laundered. Bybit is offering... To the point where almost no country was untouched by a cyber attack from North Korea. Members of the conspiracy are responsible for some of the most damaging and most well-known cyber intrusions in history. The cyber heist of Bangladesh Bank and creating the WannaCry ransomware. I think one of their attacks on this WannaCry ransomware even hit the UK's National Health Service.

15:43Absolutely. When they got involved. I think they suffered a particularly hard blow. Emergency departments were affected. Urgent appointments had to be rescheduled. So the tentacles of the Lazarus Group reach all across the globe. Absolutely. That one, thankfully, was stopped by a white hat hacker. But otherwise, you know, we interviewed somebody who is lying on the operating table ready to get heart surgery. And all of a sudden, all the monitors just went black. And so it used to be that we could identify the hackers because they would leave these little breadcrumbs because they weren't perfect. There'd either be a slight misspelling, a little awkwardness. And I myself am the target of a lot of hacks from attempted hacks by the North Koreans.

16:26Yeah, I can imagine. And there would always be a little clue that would give it away. AI makes it so much harder to identify that. It allows them to not only smooth things out, come off as totally fluent, but the more worrying thing is that it helps them accelerate the formulas and the process so that they can speed up that, the hacking to a point where we can't keep up with it. And who are North Korea. And I started to see the investment that Kim Jong-un, just as he was the leader of North Korea, just as he was coming to power, he's a millennial. And there was so much investment in science and technology, which I found so interesting. Because when you go to North Korea, it feels like you're

17:18stepping back in time. It's a very militarized society. And you rise in status in North Korea through a show of patriotism. And for this generation, that patriotism is through science and technology. And for these young men, young women, they're pressed into military service for many, many years. And I was seeing it is following that path to becoming a hacker and earning money for the regime, for the leadership, for your country through cyber theft. And maybe my picture of North Korea is antiquated, but I think if North Korea is a country that can't feed many, many of its own people, where the internet is severely restricted. So there seems to be a contradiction there, in my mind, between a country that is backwards in many ways and one

18:09that is absolutely at the forefront of this kind of crime. How do you square that circle? With North Korea, both things are true. And that is partly about allocation of resources, and it's also about control. And so resources like the internet are very carefully controlled because the leadership does want to limit the population's access to the outside world, but it is very carefully doled out to certain people who've proven their loyalty and have the potential and the trust of the regime and the leadership to have access to the outside world. And so I think that that is what also allows them to fly under the radar, is that we underestimate their capability. There was a group of young men who were sent primarily to China and were sent there to get

18:58some training. And I would say not only to get training, but to learn how we live in order for them to hack us. They also need to understand how our lives are online, how we live online. And they're able to use that time blending in in China to see how the world works in order to wage these cyber attacks to steal from us. That's quite sinister, isn't it? And how young are they? Are they selecting these potential hackers? Do they wait until they're 18 and it's like an alternative military service? Or are they picking out like the brightest kid in the science class aged 11 or something? We did speak to one young man who was an example of who might be the perfect person to become a hacker in North Korea, somebody who showed

19:47exceptional promise at mathematics. And so they look for what we call, you know, a math genius and pluck them from school and just ply them with these resources. They get a laptop and they're encouraged. It's like an academy of sorts. They'll go to a special afterschool program where they're encouraged to learn how to use the sorts. They'll go to a special after-school program where they're encouraged to learn how to use the computer. They get internet access and enticed down this path where science and technology is going to be their ticket to a comfortable life, their family's ticket to a comfortable life. Coming up, what Kim Jong-un will buy with his ill-gotten gains. NASA is the new award-winning documentary that the Israeli government doesn't want you to see.

20:57Directed by two of the Oscar-winning directors of No Other Land, NASA reveals the secret systems used by the Israeli military in the mass killing of Palestinian civilians in Gaza. Time Out says, New York Magazine has called it one of the most important films of our time. Naza, the most critically acclaimed documentary of this year, is available in cinemas now. together and make sense of what to do next. Connect accounts from more than 14,000 financial institutions and see how all the different pieces of your financial life fit together. With Quicken, you can make sense of your options and decide what to do next. Quicken. Know what to do next. See how at Quicken.com. Running a small business means wearing a lot of hats. Between managing employees,

22:01handling payroll, and keeping up with paperwork, there's a lot to juggle. Luckily, Gusto makes it easier. Gusto is online payroll and benefits software built for small businesses. It's all-in-one, remote-friendly, and incredibly easy to use. So you can pay, hire, onboard, and support your team from anywhere. From automatic payroll tax filing to simple direct deposits and benefits options for nearly every budget, Gusto helps simplify the process. Plus, enjoy unlimited payroll runs for one monthly price with no hidden fees or surprises. And with automated tools for onboarding and offer letters, you can focus on what matters most. Try Gusto today at gusto.com slash tech and get three months free when you run your first payroll. That's three months of free payroll at gusto.com slash tech. One more time, gusto.com slash tech.

22:54So with this latest hack, the North Koreans seem to have got away with billions of dollars. Dare I ask what Kim Jong-un will spend the money on? We suspect that a good chunk of that money goes toward the nuclear weapons program. And of course, for decades, the United Nations has been trying to impose sanctions on North Korea to try to slow or stop and limit their ability to earn money that goes into the nuclear program. But North Koreans have been circumventing sanctions for many years. And I think that Kim Jong-un, being a millennial who was educated in Switzerland, saw how the world was changing and built that into a strategy. How do I build this nuclear program at a time when sanctions are making it so difficult for them to earn money? He saw this investment in cyber theft as a low cost way to get around sanctions, to get around border restrictions. And so it was for him a valuable investment.

23:54Yeah, smart move. This is millions, billions now of money potentially going into the nuclear program. They have reached a point with their nuclear capability where they are trying to compel the United States and the other superpowers to accept North Korea as a nuclear power in this small club of countries that is allowed to hold on to their nuclear weapons. What that means is if we do accept North Korea as a nuclear power, we have essentially given any rogue nation the template for how to do that. If we do that, then we're also running the risk of seeing a nuclear arms race in the region. Oh, goodness. This is terrifying. It is terrifying. And I do feel like it's my, you know, I am, I do feel like it's my responsibility to terrify everybody and just make them pay attention to what the consequences are.

24:53Yeah, exactly. It's not just some lark. And do you think Kim Jong-un will have observed what's played out in the past week with the Binance hack? And what will he be thinking? Will he be thinking, great, what next? Or will he stop there? Oh, no, I don't think that they're going to stop. I think that cyber theft is a core part of their economy now. And I could not have imagined 6.3 billion in one fell swoop. And of course, cyber companies are getting better at finding ways to freeze that money and to claw some of it back. But even a portion of it, just a couple billion, that's a lot of money. And the North Koreans can do a lot with that. Now, what we need to see is how President Donald Trump handles this.

25:38What we do know is that I do think he wants to meet with Kim Jong-un before he leaves office. Can he do something to bring this under control? And yet the negotiation today, or even in the next few years, over how to reign North Korea in is going to be far more difficult than it was when he engaged in this type of diplomacy in 2018 and 2019. The nuclear program has advanced exponentially, and North Korea's confidence, Kim Jong-un's confidence is so much more emboldened. He now has Russia on his side. So I think what we have to hope is that President Trump is able to find some way to come to an agreement with Kim Jong-un that doesn't jeopardize all of our security. Yeah. Oh, gosh. I have to say that doesn't give me a tremendous amount of hope.

26:28Thank you, Jean, as ever. Lovely to talk to you. Thank you so much. And don't click on any suspicious links. That was Jean Lee. My huge thanks to her. You can find her excellent podcast, The Lazarus Heist, on BBC Sounds or wherever you get your podcasts. If you appreciated this episode, and of course, I hope that you did, please leave us a review. We always enjoy hearing what you think of the show. If you would prefer to slide silently into our inboxes, you can email us at tiff, T-I-F, today in focus, tiff.questions at theguardian.com. After the huge defeat for Trump's Republicans in the US midterms, Politics Weekly America with Jonathan Friedland has all of the reaction right now. We will also have an update in your feeds later on with the latest,

27:14and we will be covering the midterms tomorrow morning too. And that is all for today. This episode was produced by Tom Glasser, George McDonagh and Hannah Adan, and presented by me, Helen Pidd. Sound design was by Ross Burns and the executive producers were Humma Khalili and Sammy Kent. We'll be back in your feeds this afternoon with the latest. This is The Guardian. You save. You invest. you keep an eye on spending. So why do your finances still feel so complicated? Quicken helps you put the whole picture together and make sense of what to do next. Connect accounts from more than 14,000 financial institutions and see how all the different pieces of your financial life fit together. With Quicken, you can make sense of your options and decide what to do next.

28:08Quicken. Know what to do next. See how at Quicken.com. You're either all in on this model, or maybe you're building with another. You're either speed, or is it security? You're either custom, or are you ready to use? Or you're AWS AI. With hundreds of models, ready-to-use agents, speed and security built in, you don't have to pick a side. You can have them all. How will AI revolutionize your business? AWS AI is how. Shipping, billing, admin, payroll, marketing. You're managing all the things. So why waste time sending important documents the old-fashioned way? Mail and ship when you want, how you want with Stamps.com. Print postage on demand 24-7 and schedule pickups from your office or home.

29:00Save up to 90% with automated rate shopping. That's why over 1 million small businesses trust Stamps.com. Go to Stamps.com and use code PODCAST to try Stamps.com risk-free for 60 days.