The Breakdown - No, the Twitter Hack Wasn't about Bitcoin

Episode Date: July 17, 2020

Today on the Brief: Adjustment to bank profits in anticipation of growing debt delinquency  The lowest decrease in jobless claims since March  A boost in retail spending  Today’s main discussion: The Great Twitter Hack, feat. Dr. Tom Robinson, chief scientist and co-founder of Elliptic  Wednesday, at around 2:15 p.m. EDT, prominent Crypto Twitter accounts started sharing a similar message about a bitcoin giveaway. A couple of hours later, Elon Musk and Bill Gates were saying they were feeling generous and wanting to give bitcoin away. A couple more hours and every verified blue check mark account on Twitter was taken down.  It was an attack with massive implications, if not much monetary gain.  On this episode NLW breaks down: What happened Which accounts were impacted How much BTC was transferred  The narrative battle of “bitcoin scam” vs. “Twitter hack” Why it might have been a state-sponsored attack Why the real intention might have been to discredit Twitter  Why the (supposed) revelations about Twitter’s administrative tools could end up in a congressional inquiry  Expert commentary provided by Dr. Tom Robinson. Find our guest online: Elliptic website: Elliptic.co  Twitter: @tomrobin    

Yesterday, one of the most significant, perhaps the most significant attack in U.S. social media history occurred as every verified account on Twitter, all the blue check marks ultimately had to come down as hackers took over everyone from Coinbase to Kanye West in an apparent Bitcoin scam, or at least that's the popular narrative. On this episode of The Breakdown, I'll be looking at one, whether this was good or bad for Bitcoin, and two, why, frankly, I don't believe it even was about Bitcoin. Welcome back to The Breakdown, an everyday analysis breaking down the most important stories in Bitcoin, Crypto, and Beyond. This episode is sponsored by BitStamp and Crypto.com. The breakdown is produced and distributed by CoinDes.

And now, here's your host, NLW. Welcome back to the breakdown. It is Thursday, July 16th, and boy, howdy, you know exactly what this show is about because it's all that anyone is talking about. The biggest hack, I think, in many ways in terms of potential significance, in terms of the amount of data that was compromised, in terms of the implications of what hackers could do in these platforms that are our new public squares, we are talking about the Twitter hack.

Notably, I said it's a Twitter hack, not a Bitcoin hack, which we'll get into. But before that, let's do a very brief, brief, and we're going to do it in three sets of numbers. The first set of numbers is 35 billion and 84%. The first number is the amount that six US bank giants cut from their profits in anticipation of potentially souring loans as this economic disturbance continues. The second percentage is the percentage of borrowers responding, to a Goldman Sachs survey of small businesses who anticipate exhausting their funding by the first week of August. That's 84%. Only 16% of businesses responding to that survey are confident that they can keep paying staff without more support. So why are these numbers significant?

This is exactly where an economic crisis could become a banking crisis. If we see a major turn to defaults, and problems on either the consumer or the commercial side with people or companies not being able to pay their debts, that could create major turmoil for bank sheet balances. That said, the signals are massively mixed. Right now, for example, serious delinquency rates on consumer debt is actually down from the end of March to the end of June. Everyone from Jamie Diamond on down has noted just how confusing this crisis is, which is part of why banks are trying to be responsible by cutting these profits. As with so much right now, it really is going to depend on what happens from a health perspective more than anything else. Which brings us to our second set of

numbers, 10,000 and 1.3 million. 10,000 is the size of the decrease in the number of new initial jobless claims, and 1.3 million is the total number of those claims. This is the smallest weekly declined since March, which shows clearly a sign of a stalled labor market and a sign of a stalled recovery. In fact, without seasonal adjustments, initial claims rose by 108,800 to 1.5 million, which would be the first increase since early April. I've spoken regularly about how the jobless claims number are sort of the antithetical other element of how we determine the real health of the economy on the other side of stock market prices, which can be totally in a different direction. Seeing these numbers see their smallest decline ever reflects, I think, what we're

seeing in the numbers of cases increasing around the country with something like 39 or 40 states now seeing a rise in cases again. Until that stops happening, until we shift that again to the decline, it's unlikely to me that we're going to see any meaningful drop in these sort of claims, because businesses aren't going to know what to do, and consumers aren't going to go out there and spend. Which brings us to our third number in the brief, 7.5% and 524.3 billion. That's the growth and total amount of retail sales in June. It was driven by an increase in purchases of automobiles, furniture, clothing, electronics, and unfortunately, the news of those jobless claims and the growth in the cases

are taking the edge off the good news or the otherwise good news that would have been in terms of those increase in retail expenditures. If you'll remember, at the beginning of June, there was more optimism that things were getting under control. As these numbers keep reaching all-time highs and growth all-time highs, it may be that consumers again, in fact, it is most likely that consumers again will curb their spending habits. So basically, the collective story of the brief is an economy that is very confused and just waiting for more insight into what happens next, both in terms of the public health crisis and in terms of whether the government will or will not extend the benefit programs for both individuals and businesses. All right, now for our main topic, and like I said,

I know you knew it was coming. I had more of you asked last night for this as the show than I've ever seen, I think, for a topic, which makes sense. It was a pretty singular event in not just Bitcoin history, but in internet history. So first up, let's talk about what happens. Around 2.15 p.m. Eastern time, Angelo BTC's account started saying a weird message. It said something to the effect of, we've partnered with Crypto for Health that are giving back 5,000 Bitcoin. Within a few minutes, accounts from Gemini, CZ, Binance, Coin desk, Justin Sun, Tron, and many others sent out the exact same message. In fact, CZ from Binance tried to actually warn about this before having it come out of his account as well. Within a couple hours, it had switched over to celebrities. Around 4.15 p.m.,

Elon Musk kicked off the celeb hacks, and they went all the way to 615, kind of concluding in some ways with Kim Kardashian. Over that period of time, they got Elon, Apple, Bezos, Uber, Bill Gates, Kanye Obama, Biden, right? So it was unbelievable. The followers of all of these accounts amounted to more than 300 million users. The tweets were all some version of, I'm feeling generous or I'm feeling like I need to give back, send me XBT, and I'll send back 2x in the next half an hour. And of course, there was a Bitcoin address. It got so bad and was so omnipresent that Twitter eventually had to turn off verified users, aka the blue checkmarks, entirely. Those accounts didn't come back until later that night, and some of them still even aren't back yet. Almost immediately, as you

would imagine, there was a narrative battle. Was this, on the one hand, a quote, Bitcoin scam, Or was it on the other a Twitter failure? Or for a more savvy audience, a failure of centralization. Let's talk about the Twitter failure narrative first. Ultimately, and this can't be stressed enough, what got hacked here was Twitter. It was not Bitcoin. Bitcoin continues its run of 99.98% uptime without a hack like this.

It was Twitter, not Bitcoin that got hacked. Many made this point, including a sitting U.S. congressman in Tom Emmer, who said, Bitcoin isn't the problem, centralized control is. As you can tell from my tone, I think it's pretty undeniable that this was a Twitter failure, first and foremost, and many people got that. Blockfolio put it really nicely this morning. They wrote, this was plain and simple, a centralized platform that was hacked.

It was a radical demonstration of the problems of centralization and single points of failure. It was, in other words, an attack that exposed the vulnerability at the very center of the raise on debt for Bitcoin. Ultimately, however, we're talking about a narrative battle, and when people are talking about narratives, motivation matters. A lot of the narrative has focused on motivation. And beyond a shadow of a doubt, the biggest sort of denominator in all of the articles or most of the articles that came out about this was Bitcoin scam. Here's just a quick sample of some of the more prominent ones that I saw. The New York Times said, a brazen online attack targets VIP Twitter users in a Bitcoin scam.

BBC News, major U.S. Twitter accounts hacked in Bitcoin scam. The Economic Times, Twitter's Bitcoin hack signals political danger. AP, Biden Gates, other Twitter accounts hacked in Bitcoin scam. Bloomberg, Twitter hack hits Obama Biden-Musk in Bitcoin scam. And finally, Fox business, Twitter Bitcoin hack, list of affected accounts including Elon Musk and Bill Gates. My mom sent me a message on Facebook that had the Bitcoin scam language and said, uh-oh. We're later going to get into the potential cost. or threat to Bitcoin of that sort of narrative. But I want to focus now on this other piece of this,

which is that even as this Bitcoin scam, quote-unquote, was happening, a lot of people noticed that there really wasn't much money being transferred. And frankly, it seemed like if their real goal was money, they could have made a lot more in a lot of ways. BitStamp is the original global cryptocurrency exchange. Since 2011, BitStamp has been the preferred exchange for serious traders and investors, trusted by over 4 million customers, including top financial institutions.

BitStamp is built on professional grade trading technology. Their platform is powered by a NASDAQ matching engine, and their APIs are recognized as the best in the industry. Download the BitStamp app from the App Store or Google Play, or visit bitstamp.net slash pro to learn more and start trading today. That's bitstamp.net slash pro. What's going on, guys? I'm excited to share that one of this month's breakdown sponsors is Crypto.com. Crypto.com offers one of the most cost-efficient ways to purchase crypto out there, as they've just waived the 3.5% credit card fee for all crypto purchases. What's more? With crypto.com's

MCO Visa card, you can get up to 10% back on things like food and grocery shopping. When you buy gift cards with the crypto.com app, you can get up to 20% back. Download the crypto.com app today and enjoy these offers until the end of September. A common sentiment on crypto Twitter was, really you're using all of this power to take over the most significant Twitter accounts in the world and you're using it to try to get a smattering of Bitcoin from really gullible people? Naval put it really bluntly. He said, hacking Elon's Twitter account and using it for a crypto scam rather than a stock trading scam shows a complete lack of imagination. Echoing that the top meme today on Wall Street bets on Reddit was exactly about this as well.

it was basically saying that Elon should have tweeted out that he was going to take Hertz private at 69.420 per share. But let's actually get clear on how much money was moved and in what type of denominations. I did a quick interview this morning with Tom Robinson from Elliptic, which is a blockchain analysis service. So Tom, when did you guys at Elliptic notice that something fishy was going on? So I think like many other people, we started to see some major, crypto exchanges and companies start posting tweets to what were clearly scams. So we started collecting the crypto addresses that were being used and immediately uploading them to our system. It became very clear, very quickly that this was a pretty big deal in terms of just the size

of the accounts and the consistency, right? It didn't take long. Absolutely, yeah. And it seemed to progress from crypto-specific Twitter accounts to mainstream celebrities, corporations. So it became clear quite quickly. This wasn't a crypto-specific phenomenon. I think a lot of folks who are seeing this assumed that no one would actually send money, right? I mean, this is such a, this reads like a scam from two or three years ago, right, in some ways. But what did you actually observe? Yeah. And so when the tweets were being posted by crypto companies, people were were making payments to these addresses, but it wasn't on a huge scale. Maybe in the first half hour or so, a few thousand dollars were paid.

However, when the tweet started appearing from Elon Musk and Bill Gates and Apple and Uber, that's when the payments really started to accelerate and nearly $100,000 was raised over around an hour period. Do you have any sense of how many different people actually sent money or what the rough size of the kind of average participant was? Yeah, so there were approximately 400 payments made, so you could make the assumption that that's around 400 victims. The amount paid did vary a lot. For example, the largest payment was for over four bitcoins. And that came from an address, which we could trace back to a Japanese exchange. So more than likely, a Japanese individual. This is total speculation on your part, obviously, which is kind of the opposite of what your business is.

But, I mean, does it seem to you seeing these numbers, seeing the sizes, do you think these are kind of regular people who were caught up in this? Do you think it was people who were just like, hey, I can afford to lose, you know, 50 in BTC if it's actually real? Or do you think it was, is there any chance it was people who were kind of actively participating in the scheme to try to increase these numbers knowing that firms like Elliptic would be watching it and hopefully kind of reinforcing the narrative that, yes, some people were actually doing it? So it's hard to come to any conclusions yet. I mean, it seems to me as though the victims were mainly people who already had crypto

or already had accounts on crypto exchanges. So I don't think many of these payments came from complete crypto newbies, for example. I think these are people who already had some involvement in crypto. And I think that's probably one of the reasons why this didn't raise as much money as you might expect. I think, you know, there is a barrier for the everyday person to get hold of Bitcoin and send it to an address like this. And so I think that limited how much was raised. What is your read on where this fits in terms of kind of the long, illustrious and disignaminious history of crypto scams? I guess the thing that people are finding so fascinating about it is the

disproportionate nature of the power wielded in terms of the accounts they hacked into versus the likely return. Right, yes. And yes, it was interesting that they chose this mechanism to monetize what was obviously a very powerful exploit. You would have thought that perhaps there were other ways of raising more money through this exploit. But it's something we've seen in the past.

So, for example, if you look back at the Wanna Cry ransomware attack, that was based on a very powerful exploit that was able to infect tens of thousands of computer systems all around the world with this malware, but they didn't actually raise that much in terms of the Bitcoin payments, maybe $50,000 or so. And so we often do see this mismatch between the power of the exploit and the ability of the exploiter to monetize it. They're very sophisticated, techians computer systems. They're not very sophisticated in terms of extorting money out of people. Well, and I guess it could be as well that we're kind of viewing it from the global harm, it seems like they could have done with access to these accounts. But if they simply had

figured out this exploit and were looking for the best way to actually get away with some cash, and they didn't have any interest or nefarious interest in disrupting the global political order, I mean, I guess this is kind of as good as you can get for a quick buck, right? Absolutely, yes. Yes, if you want to raise a reasonable amount of money and a short period of time in a way that can't be blocked and which is relatively difficult to trace, then yes, perhaps this is the obvious choice. Very, very interesting stuff. Well, Tom, thank you so much for jumping on so quickly after this happened.

Where can people follow you or Elliptic if they want to keep up with the story as it evolves? Yep, so you can follow Elliptic at Elliptic on Twitter, and I am at Tom Robin on Twitter. Wonderful. Thanks so much again, Tom. Thank you. To reiterate, there really wasn't much money moves. relative to the impressions that they must have gotten across all of these different accounts, they only got something like 100,000 or a little more than 100,000 in Bitcoin.

This is a very small pool of resources, frankly. Given that, it seems to me like there are two main possibilities. Either one, they had a way different estimate of how gullible people were and thought they could make a lot more, or two, they had fundamentally different motivations. So what might those fundamentally different motivations be? One theory that has been bandied around is the idea that this was state-level actors. Ben Hunt, responding to someone who had said that they could make so much more money doing something different with these accounts, said,

so much more money. Makes me think this was state-sponsored rather than criminal-sponsored. But what would the motivation be in this case? Well, one possibility is to try to undermine the U.S. and show how fragile its key communication systems are. Twitter, we have to remember, is not just another so- media service. It's one of the main ways that the president speaks directly to the population. Showing that the most senior, significant, important accounts, right, ex-presidents like Obama,

the biggest accounts on the platform could be compromised in this way, even if it was just for something stupid like a tiny little crypto scam, might be in the interest of someone who wants to show the U.S. as fundamentally weak and vulnerable. Silicon Valley entrepreneur Aram tweeted, imagine if the hackers had started with Trump announcing we were under attack and he was launching nukes. It's sobering to realize how much damage Twitter's shit security can cause. Mike Chernovich was more dramatic. He said Twitter admins have the power to post on behalf of world leaders. One employee could start World War III with a tweet.

Which brings us to our second theory of why someone might be motivated to do this if it wasn't just about the money. And that has to do with exposing or trying to take down Twitter itself. Most of the mainstream media accounts of this have focused on who got hacked and what it was for and the Bitcoin scam asset of it, but Motherboard by Vice had a very different take, and I'm actually going to read some extensive sections from it because it's important. This was written by Joseph Cox and is called Hackers Convinced Twitter Employee to Help Them Highjack Accounts. A Twitter insider was responsible for a wave of high-profile account takeovers on Wednesday, according to leaked screenshots obtained by Motherboard and two sources who took over accounts.

Quote, we use a rep that literally done all the work for us, one of the sources told Motherboard. The second source added that they paid the Twitter insider. Motherboard granted the sources anonymity to speak candidly about a security incident. A Twitter spokesperson told Motherboard that the company is still investigating whether the employee hijacked the accounts themselves or gave hackers access to the tool. The accounts were taken over using an internal tool at Twitter board, according to the sources, well as screenshots of the tool obtained by motherboard. One of the screenshots shows the panel and account of Binance. Binance is one of the accounts that hackers took over today. According to screenshots

seen by motherboard, at least some of the accounts appeared have been compromised by changing the email address associated with them using the tool. In all, four sources close to or inside the underground hacking community provided motherboard with screenshots of the user tool. Now, here's where things get really dicey and where the biggest part of intrigue, I think, is coming from. This supposed tool, which has not been confirmed by Twitter, shows a panel of options for admins that includes a number of different controls over people's accounts. So one panel has permanently suspended, suspended, bounced, or protected as statuses for a user's account, but then another one says compromised, trends blacklist, search blacklist, or read only. What this has

done, as you might imagine, is radically reignite claims of the ability to shadow ban, not just individuals, but even when it comes to trends. Charlie Warzel of the New York Times wrote, the first thing I thought when I saw this screenshot of the Twitter backend system is that, real or not, it is going to massively reignite the Twitter shadow ban's the right narrative, like Ted Cruz and Donald Trump Jr. are going to be tweeting it within a few hours. Of course, even people who weren't on the political right were wondering whether we should be spending more time about figuring out whether it's real or not, because that has pretty significant implications. Zero Hedge wrote, well, there it is, Twitter's internal blacklisting module exposed for everyone

to see. A shi storm is coming. From motherboard again, they wrote, within an hour of the breach, Republican Senator Josh Hawley wrote a letter to Twitter CEO Jack Dorsey, asking for more information about the hack, including how the hack occurred, how many users were compromised, and whether the hack affected President Trump's account. Holly said, please reach out immediately to the Department of Justice and the Federal Bureau of Investigation and take any necessary measures to secure the site before this breach expands. There are clearly here political implications that come from the fact that this question of public speech and shadow bans is so inflammatory right now. Whether it should be or not, it is at the center of a question of

power balances in this country. And this admin panel, like it or not, is going to have a major stake in that. Given how high traction this political debate is right now, given that it's pushed regularly and aggressively by the president himself, it seems very likely to me that Twitter is going to either, one, have to prove very aggressively and conclusively that these screenshots are fake, or two, come to Congress and explain what's going on. But that, I suppose, will be a discussion for when it actually happens. So let's try to wrap this thing up in a few little bits and get into this discussion of whether this is good or bad for Bitcoin. So first, my takeaways. One, in many ways, I have a hard time believing that this was strictly speaking about Bitcoin. It just seems to me

that people who are smart enough to execute this attack couldn't have had high expectations for how many Bitcoin they were going to get. We've just lived through too many years of digital scams for them to have expected that any meaningful percentage of people were going to actually respond. They were also limiting themselves effectively to folks who already had Bitcoin at that time. What's more, to the extent that they had to pay off someone in Twitter, I can't imagine that it was cheap to do so. You're talking about something that has not only career implications, but obviously federal crime implications as well. Second, I think that both the state attack narrative and the take-down Twitter narrative need to at least be taken seriously, even if we don't want to jump

to conclusions on either of them. With regard to state-level attacks, it is absolutely terrifying to think about and seems, frankly, well within some nefarious countries or actors' interests to show their power A and B to show frailty in the U.S. system. One potential limiting factor to me is why not just go for something more disruptive right away? Why not actually have a politician tweet out something damaging. Perhaps it was just a flex of muscle to show what power there was, but it seems like if you really wanted to make the point about the frailty of America, you would make one of our leaders look stupider than just a clear and obvious and immediately obvious transparent scam like this. With regard to the question of whether it was about

reducing Twitter as a source of trust and trying to really effectively hamper it in the long run, I would not be surprised. Twitter is at the center of this major social media debate that is in itself a free speech debate, and it's made an enemy of the U.S. president. So I think that, again, we have to, one, not jump to conclusions, but two, take it more seriously than we might otherwise have. Now, three, let's talk about whether this is good or bad for Bitcoin. And frankly, and probably annoyingly, I think it's really murky. First, in the case of either the above scenarios, either state-level attacks or Twitter as a source of trust in trying to undermine that, Bitcoin does makes sort of a perfect fall man. And this reinforces the point which makes it bad, which is,

as the Blockworks Group Jason Yanowitz put it, it furthers Bitcoin's association with scams. Marquez Brownlee, who has 4 million followers on Twitter, wrote, were you there the day every major Twitter account was compromised in a gigantic Bitcoin scam? Now, a counterpoint to this that some have made is that people who think that Bitcoin is for scams already weren't buying, so its ability to actually harm the asset might be limited. But I think there's something else that's more scary to me, which is that it creates context for the enemies of Bitcoin. Josh Barrow is a business columnist for New York Magazine, and he says, you know, we wouldn't have to worry about this sort of thing if cryptocurrency was illegal. I'm not kidding. Crypto has no socially beneficial use

cases and quite a few socially harmful ones. Why is it allowed? The point here is not Josh Barrow, who can be attacked and disagreed with on Twitter, which he was vociferously. But imagine Secretary Mnuchin saying something like that. Imagine President Trump saying something like that. It certainly doesn't seem beyond the pale, and frankly, who wants to step up and defend that fight outside of our crazy selves? So for me, when it comes to the bad side, I'm perhaps less worried about immediate reputational harm among the average person, and more about the context it creates for enemies in the long term. I think that the good things, the potential upsides, are a little bit more debatable or abstract. The most obvious good way to read this is that

it's a lot of exposure. I mean, even today, Joe Biden tweeted out that he didn't have Bitcoin and he would never ask you for any, but if you wanted to support his campaign, blah, blah, blah, blah. So this idea is that any press is good press perspective, and there certainly was some evidence for this. Blake Robbins, who's an investor, who's involved in e-sports, wrote, I sort of want to buy Bitcoin now. So I think that there is some truth to this any press's good press perspective. A slightly less obvious, at least to a normie idea, is the idea that this is a centralization issue, not a Bitcoin issue. Sahel Bloom wrote, people seem focused on whether the hack was good or bad for Bitcoin, that is missing the forest for the trees. The hack very publicly exposed the inherent

vulnerability of single point of failure systems. That is the real story. Long decentralization. I certainly agree with Sahil in terms of his analysis of the situation. What I'm less sure of is how much this is going to resonate with the average person, especially under the barrage of Bitcoin scam headlines that we went through before. An even more abstract upside is the idea that this is good because it shows how hard to capture and reverse Bitcoin transactions are. I think that it's a decent point from a technology perspective, but I don't think it's going to win you a lot of good headlines or positive press. To be a little bit more fake, scientific, I asked on Twitter about this exact question. I said, was this good for Bitcoin or

was this bad for Bitcoin? Argue intensely in the comments. 831 respondents had 61.7% said good for Bitcoin. 38.3% said bad for Bitcoin. I also saw a ton of, because there were a lot of comments, a ton of people saying it doesn't matter for Bitcoin, right? Bitcoin is neutral. It's going to be a wash too, right? The good evens out, the bad, and there's some of both. And I think that that's a decent point as well. I think if I had to push, I'd come down slightly on the bad side, frankly, because of the context that it creates for political narratives and enemies in the future. Sure, I think the longer this goes on, the more it will be seen as a Twitter problem, not a Bitcoin problem. But I still think that

that the logic that Josh Barrow shows, crypto has no socially beneficial uses and quite a few socially harmful uses, is highly compelling in a sort of trying to sound smart kind of political way. So that's my biggest concern. I'll leave you with the most boring possibility, too, because I think that when this happens and something so big happens, we forget that it's just usually pretty regular people who are involved. And so let's paint the story that's not a state-level actor, right?

China or Russia or someone else nefarious coming in and doing this, and is not, on the other hand, some radical internal political group trying to get Twitter taken out. But it's just a group of people that, one, figured out this exploit or figured out how with the help of some friend they had at Twitter they could make this exploit, genuinely don't care about state-level chaos, or even actively don't want to perpetuate that level of chaos. And then from there, want to just, A, show off their hacking skills, and two, make a hard-to-trace buck. Maybe they decided that this was, even though inefficient and likely to only net them so much, still the best possible way to get some money fast that was mostly untraceable or at least

uncapturable. It's so boring. This is the most boring version of this story than I can imagine. But in some ways, that makes me wonder if that's actually the case. Of course, we don't know now. And frankly, I think in a lot of ways, as already we're seeing, the bigger implications of the story aren't just exactly what the motivation was for the hack. but what it exposed about these incredibly important social and political systems that come through

and run through these platforms like Twitter. I expect that as time goes on, that's more where the debate will focus. And that's probably a good thing. For now, guys, let me know what you thought of this show. Let me know if you thought my analysis was right on or totally bunk. I appreciate you guys listening. I appreciate you guys rating and reviewing the show. As I've said, a bunch of the last few weeks, it really makes a big difference. So if you like this show, go rate it and review it. And until tomorrow, be safe and take care of each other. Peace.