Inside the $285M Drift Protocol Heist | Ari Redbord

perspective, you know, I think there's almost like a misconception that like cryptocurrency is fully anonymous and that's certainly not the case, right? I mean, transactions are still being recorded and can be traced at some level. That's what's really extraordinary about the technology and that's very much we what we do, we provide for law enforcement. It's really tracing and tracking software. It allows them to track and trace every transaction on public blockchains, which are immutable public ledgers, which means every transaction is logged and forever.

So it allows law enforcement to track and trace the flow of illicit proceeds. So if you have a ransomware attack or you have a hack law enforcement, think FBI or IRS, criminal investigation, DEA, Secret Service, they use TRM to track and trace those flows, ultimately with the goal of building an investigation, prosecution, A seizure, forfeiture action and getting those funds back from those bad actors. So that's really the extraordinary thing about this technology. You know, I spent my career as an AUSA investigating cases involving bulk cash smuggling and networks of hawalas and shell companies and high value art and real estate, right?

There was no TRM to track and trace those things on open ledgers. And it's really extraordinary. It's a really extraordinary capability today when it comes to investigations and compliance. Yeah, that's really interesting. I'm sure that you have some fascinating stories, just like being able to trace these types of things over the years even outside of cybercrime. Like do you have any like specific incidents that maybe you track that is? There, there, there are really so many. I mean, I would encourage your, your listeners. We put at least one blog post every week about law enforcement sort of really using our technology to track and trace, you know, illicit proceeds.

And, and there's so many examples years ago, I feel like, and maybe for your audience, particularly interesting. You know, you had the Colonial Pipeline attack, which to me was like this just extraordinary watershed moment when cybercrime went from being, you know, I think something that wasn't a law enforcement focus and, and maybe an annoyance to something that really became a global security issue. You know, you're shutting down the gas supply to the the East Coast of the United States. I remember, you know, waiting in line in, in, in Washington to get gas.

FBI used our tool to track and trace that ransom payment and was ultimately able to use their tools to seize back. And really, I mean, over the last five years since then, as I said, there's just myriad examples of law enforcement using these types of tools really more and more at scale. And we see, we've seen recent investigations involving Iran, North Korea, you know, ransomware groups, Russian sanctions evasion. What what what's happening really is that as we move fully into a digital space, bad actors are also moving funds on block chains, right, in ways that they never did before. And the ecosystem is growing and so is sort of illicit activity. You mentioned a report that we put out a few months ago, sort of our crypto crime report.

We said that there was about $158 billion in crypto related crime in 2025. That is a record setting year. It's still made-up only about 1.3% of all activity within the crypto ecosystem. So we're talking about a relatively small percentage of overall activity, but it's still, you know, 1.3%. That keeps me up at night because it involves North Korea hacks, it involves ransomware and terror financing, But the bottom line is more and more activity is happening in crypto, both lawful activity and and illicit activity. Yeah, absolutely.

And you know, you mentioned the Colonial Pipeline ransomware attack. I still remember when the DOJ came out and said, hey, we were able to get all this, you know, essentially recover these funds from that. That was a really interesting point because, you know, at that point, I think the government was also saying, look, if you work with us and collaborate with us, then here's like what we have the capabilities to do and we can, you know, kind of recover this. So, you know, I think there's a really interesting, you know, I guess angle there in terms of how that these attacks or incidents play out after they happen with capturing that, being able to capture that money back. Yeah, absolutely.

And you know, look, we are an investigative tool and law enforcement is sort of using us to track and trace these funds. And, you know, we we've seen that also recently right now, there's been this proliferation of scams really driven by transnational cybercrime groups. There was a recent takedown of a group called the Prince Group in Cambodia, for example, where the US was able to actually seize and begin a forfeiture action for $15 billion, the largest ever forfeiture in U.S. history.

I think the largest forfeiture of anything anywhere in history. And it's really an only in crypto story because bad actors are now able to move larger amounts of funds faster cross-border than ever before. But the paradox is we can now track and trace them and potentially seize them back, back for the victims, back for law enforcement. And I think that's really what we're seeing now. So we're going to see more and more, right? I mean, I can go through any number of different types of cases, but the reality is crypto is becoming used more and more by both good and bad actors. Yeah, it's funny, I do like to look through DOJ indictments and like, because it's always interesting. You can really figure out how FBI agents are able to kind of draw evidence and identify people that they're charging in attacks.

And a lot of the times the the crypto wallets are kind of what they're using as their primary piece of evidence there. And I think there was like a really interesting case with like one of the Scattered Spider hackers. I think it was like a few months ago where they basically they said they analyzed the blockchain and then found a wallet on a server that contained portions of the ransom payment by victims and attacks. And then they also found that that wallet had been used to buy gift cards.

And those gift cards were used for the food delivery service. So like, you know, being able to connect all these pieces. Do you think that bread actors or ransomware actors are becoming more aware that these bread crumbs are being left behind and like how to kind of pivot away from that? Or is this still very much like a, you know, something that's there and like, useful? Yeah, I know. Look, these are very sophisticated actors. There's no question, certainly from a cyber perspective.

And of course, they know and they've known for a long time that law enforcement is using blockchain intelligence tools like TRM to track and trace these payments and ultimately sees them back. You know, it's interesting. A lot of bad actors globally have gone to stable coins. They're moving to stable coins for a whole host of reasons why most why why like lawful actors are using them too. It's a way to move funds fast in a stable way tied to the US dollar. Ransomware groups are actually an exception. And someone asked me about this recently and I explained that like stablecoin issuers like Tether, like Circle, have really unique capabilities to burn and reissue their native token, which means they can actually remove it from your crypto wallet and put it in a place where you cannot access access it.

It's extraordinary. It's been a conversation that's been going on for a number of different reasons recently, post drift hack. What are the obligations of a stablecoin issue? What should they be doing here? But the reality is they have this capability and Tether has shown that they can do it at scale. They just did a 300, almost $350 million seizure, I'm sorry, freeze last week involving Iran. So ransomware actors are still looking for Bitcoin, which is unstable, but it is truly decentralized in a way that you cannot, you know, rollback transactions, you cannot freeze funds.

And that's up to the exchanges sort of not to move them. So ransomware actors are very sophisticated, but so is law enforcement. And it's this cat and mouse game that has gone on forever between the good guys and the bad guys where, you know, bad actors are early adopters of of new technology historically and law enforcement is is playing catch up. But I think that we see law enforcement more and more leaning into technology. I mean, 11 sort of important point I think to put on your question is AI has really supercharged this type of activity, the scam activity, certainly the ransomware activity. You know, we, we have always lived in a world where ransomware groups were looking for affiliates, right? They were looking for a franchisees, essentially someone who sits to sell and deploy their malware. Well, you know, in the age of AI, you don't need that, right? You can establish agents that could go out and at scale deploy your malware.

You don't have to have a revenue sharing model with anybody else. And I think it can allow, it will ultimately allow ransomware actors to move much faster to continue to attack global health systems and, and manufacturing and, and critical infrastructure, but really do it at a scale that we've never seen before. And that to me is not a national security threat. That is a civilization level threat. And that's why I I evangelize all the time that we need to be countering this activity by using technology for good. Yeah, that's, that's really fascinating. That's a great point about the use of AI as opposed to, you know, continuing to lean on the affiliate operational model. Have you seen that in I know you at the back end, you're able to collect all this data and kind of intelligence at the back like in terms of ransomware attacks, like have you seen any kind of evidence of that yet or is this?

Something we definitely, we definitely have. We, we have not necessarily seen it at scale the way we've seen scam these scam transnational criminal groups from a scam perspective, really using it from the scam perspective. I we see it in every case, the use of defect technology really targeted phishing emails. You know, they're, we're gone to the days of the Nigerian Prince and the broken English right. It's perfectly tailored phishing attacks on people.

Slightly different on the ransomware front, but we're definitely starting to see it. And to me, it's a huge, huge, huge threat. Yeah, definitely. Well, I wanted to talk to you mentioned the Drift protocol heist and that, you know, I definitely wanted to talk about that. It seems like, I mean that these crypto heists are absolutely fascinating to me just because of the sheer amount of money that criminals are able to kind of, you know, drain from them. And I know you know in the past we've had the like I think it was by bit was $1.5 billion and then Ronan network breach in 20/22 was 625,000,000.

So I and I think that it was 285,000,000 that was drift which was a couple weeks ago now. So wanted to hear your perspective on kind of what you know, your takeaways were from that specific one. Yeah. You know, as I mentioned, we put out a report today that basically ties together 2 attacks in the first four months of 2026. North Korea has stolen about 577 million already this year. Last year it was close to 2 billion. That that is 76% of all stolen crypto this year has been attributed to North Korea, which is just a stunning number. And they've gotten much better.

North Korea's been very, very good at this for a long time. I think it's important, I think, for your audience to know who he's really following this. I mean, North Korea has professionalized hacking and particularly crypto theft in a way that we've never seen from any other regime. And it's not even close. North Korea, you know, from a young age, they'll take kids who are showing aptitude for STEM and essentially train them to be cyber warriors. And people often talk about state sponsored activity in North Korea. It is not state sponsored activity. It is the state itself.

North Korea is a criminal state that has decided that without any meaningful economy, they can steal billions of dollars of cryptocurrency to fund weapons proliferation and other types of destabilizing activity. I think what's gotten so really like troubling about the situation is they've moved from sort of tech using technology to really using, you know, social engineering and scale. And you know, you mentioned the Drift protocol and you mentioned that your, your, your audience might not be, you know, super crypto native, but Drift is a trading platform built on the Solana blockchain, which is a major crypto blockchain. Think of, think of Drift is like a decentralized exchange where people can trade crypto assets.

And it is a governing body, right? You have to have some type of mechanism for, for allowing transactions to go through essentially a Security Council that's made-up of multiple signers who have to jointly approve major changes. And essentially, North Korea spent months, I mean, we're not talking about, you know, a few days here trying to breach the controls. This was months getting close to Drift's employees, meeting them in person meetings, at cryptocurrency conferences.

It's really just unprecedented. And that allowed them to ultimately get to to ultimately get control of these mechanisms that allow transactions to go through. And we're able to essentially unlock that exchange and steal $285 million. The planning was just extraordinary. And I think what it also says to me is that like, they didn't just pick drift, right? They likely picked many of these.

And I think what I'm so concerned about is that we're going to start to see a litany of these types of attacks based on essentially months or even maybe years of planning. So I, I, I, I look it, North Korea is, is, is a country and, and you know, a, a threat actor that we followed for a really long time. We have a guy at TRM named Nick Carlson. I think Nick is, Nick is a former FBI analyst who I used to work really closely with when I was a prosecutor. And we essentially went to TRM together. And he, he's one of the foremost experts in the world, But I think his, his view tends to be, Hey, crypto is just the next thing, right?

First it was, you know, counterfeit $100 bills and, and counterfeit cigarettes and narcotics. And now, now they've moved to crypto because you can actually steal funds at the speed of the Internet. Yeah, I think the The Drift Protocol hacked definitely, as you said, it shows kind of just how good, you know, these North Korean actors have gotten that social engineering. I mean it, it's played out really almost like a spy novel, like the way that. It's, it's absolutely extraordinary and it, and it's been that way for a long time.

If, if, if listeners want to go really deep on this, The Lazarus Heist podcast is excellent on the BBC with, with, with Jean Lee, who was AAP Bureau correspondent in North Korea. It's really, it's really extraordinary and goes back in time and talks about all the way sort of North Korea has professionalized this. But it's, it's something that's been going on for years and years. And, and I think they've just gotten to the point now where they it's crazy that when the US thinks about adversaries, we think about Iran and China and Russia and North Korea is even in the same breath. But it's because they've professionalized this capability to steal funds at the speed of the Internet and use it for weapons proliferation.

They're they're in the conversation and we need to fight back. When you look at North Korean actors and how they utilize, or should I say, I guess like. Cryptocurrency, how is that different from what you see with ransomware actors or not necessarily North Korean actors, just other types of cyber criminals? Yeah, no, absolutely. For North Korea, it's different, right? Cyber criminals tend to be bad actors who are motivated by greed, who are trying to steal funds that may that that are that may be state sponsored, but may just be sort of a rogue criminal element.

Think of a gang. North Korea is different, right? This is a government that has no other means of, of, of their economy. So they're stealing cryptocurrency and using it to fund their own, their, their regime essentially. I think that's, that's significant. So they launder very differently too. They launder in a way where it doesn't, you know, no one, they don't care about being caught because no one is ever going to be caught or extradited anywhere arrested from North Korea. What they care about is that they can off ramp as much of the funds as they possibly can as fast as they can. So they're using, you know, various different services. They're trying to move the funds as quickly as possible. They are using Chinese money laundering networks to actually launder the proceeds of a lot of these Chinese gangs that have been doing this for years and and really acting sort of as a nation state actor as opposed to what sort of a rogue criminal group would do.

Well, yeah, that's interesting too. I mean, in the in the Drift Protocol hack or heist, I guess, you know, they were mentioning that the initial people who were carrying out the social engineering weren't necessarily North Korean nationals. So that was almost like, you know, there's multiple different entities being involved there. Yeah, that fact really took my breath away in terms of like, you know, I mean, North Korea, it's not easy for North Korea to necessarily find people to do their bidding. And the fact that there were, you know, non North Korean people who were the ones at the conferences having this engagement. And I think it's a really interesting question that's going to lead to much more investigation from FBI and others.

Yeah, certainly. You know, when you look at like it's just over the years, like over the past what like decade and a half, two decades, like these types of attacks have really evolved. But like even looking back at like going way back, like the Mount G Ox, you know, attack and things like that, Like how have you seen these types of crypto heists or hacks like evolve over the years? They've gotten much bigger for sure, and I think the laundering has become much more sophisticated.

We now have all kinds of privacy techniques and mixers and privacy coins and other types of cross chain swaps, right? Moving funds across block chains as fast as, you know, at rapid speed in order to obfuscate the flow of funds. Mixers for your audience or essentially exchanges on block chains where you put in funds, it mixes them up with other users and sends them out clean. The other side, we trade at TRM. We trace, you know, funds through many mixers with a high, pretty high degree of confidence. But there's no question that these laundering typologies has evolved where they're using new services.

You know, for years North Korea used Tornado Cash, which is a decentralized protocol mixing protocol on Ethereum. Tornado Cash was sanctioned and then delisted. And there's all kinds of interesting drama around that. But they're looking to different services now too. You know what, what services can they move funds through that aren't going to freeze them? And you know, we highlight Thor Chain as one example of that in the report that we put out today. But there are there are plenty more. Right.

That makes sense. And I, you know, so I wanted to ask, you know, about looking at the report that you guys released from January, there were some really interesting takeaways in terms of ransomware and kind of what you're seeing there. Specifically, you know, what would be in your opinion, some of the the biggest takeaways with what you found having to do with that? You know, I think we're seeing more and more attacks. You know, there's no question. And the attack surface seems to be getting bigger and not smaller.

I think I testified last week actually before the House Homeland Security Committee and there was a discussion of ransomware one of my one of the other panelists talked about and I was a little taken back. They said about 50% of all ransomware attacks are on health systems. And to me, you know, that was pretty extraordinary where people, you know, ultimately could potentially die, who are not getting the care that they need or the electricity is going out or, or these types of issues are happening.

So I, that, that, that to me was something, you know, kind of recently to learn about. I, I think this idea of the use of AI to scale these types of attacks potentially something that we're thinking about very, very closely at TRM, but I think we're seeing the number of attacks go up. We're certainly seeing the, the, the size of these, the overall ransom payments go up. I think it's interesting. It's it's certainly a a concerning moment, but as bad actors are scaling this type of activity, I think that's that's the biggest concern through AI and other types of technology.

Yeah, that's what was really stood out to me at least was, you know, you get you're able to get a lot of good information about ransomware operations after the initial attack that actually happened. So you can see, you know, our businesses paying the ransom, like what happens to that money, how it's moved and used over time. So that's, that's really cool. And one thing that I that stood out to me when I was looking at the report as well as, you know, these the points about major disruptions that did not fully extinguish ransomware groups, but instead kind of had a little bit of like a scattering impact on them.

I always think that's fascinating because you know, you see a lot of these disruption efforts being announced and I always wonder what, you know, if they're going to have a near term impact or a long term impact and what's kind of going on behind the scenes there. So I thought that stood out to me as well. Yeah, it's a great question. It's interesting. We had our public sector summit yesterday for TRM, which we hosted about 200 federal law enforcement agencies, national security leaders in in our space.

And I, I think one sort of major theme was the idea of disruption. And I think we have to change the paradigm a little bit when it comes to sort of this new world where everything is global, cross-border, North Korea, Russia, China, right? Places where we might not necessarily be able to prioritize arrests, putting people in handcuffs and has to be like, what does disruption look like? I think disruption certainly looks like seizures. It looks like forfeitures, name and shame. But disruption I think is a little bit of what you're describing as well. And that is sort of the whack a mole concept.

And whack A mole has a very sort of negative conversation when it comes to law enforcement. But I I've always been a big believer that you got to whack some moles every once in a while. And whacking those moles adds a little friction possibly to the laundering process. You know, when you're reconstituting yourself as a new entity or a new group, that takes work, you know, are you going out and getting new affiliates? How are you? How are you what what you know, is the deal not as sweet as it was because people are worried about, you know, getting attacked themselves.

So I so I think that like, you know, adding friction to some of these processes is really useful. We're not going to end ransomware, certainly not in this sort of digital age we're we're now fully immersed in. But I do think we can make it much harder for these groups to ultimately launder and then off ramp the illicit proceeds and for your viewers or your listeners, the the world of sort of crypto crime and blockchain tracing really comes down to how fast bad actors are able to move the funds to off ramps, right.

You still need to convert those stolen funds into more usable currencies, U.S., dollars, yuan, whatever it ultimately is rubles to use them and it becomes this cat and mouse game that has always gone on between law enforcement using tools like TRM to track and trace and then that bad actor trying to off ramp those funds. You know, you mentioned the buy bit hack earlier in the wake of the buy bit hack last year, February 21st, we about 1.5 billion is the largest hack by three times. You know that that's ever happened before and we never also seen funds laundered and moved as fast. Within the first few days fund the entire 1.5 billion was converted from Ethereum to Bitcoin and then that laundering process began.

So what we realized was then that we need to move faster. We really, we need to use AI to to supercharge our tracing capabilities and, and we and we need to really, really wall off that perimeter around those block chains to ensure that bad actors aren't getting their funds back. So a few months later in August, we announced something called the Beacon Network, which is our answer to a lot of this. And that is it's the largest information sharing initiative in, in crypto. We have about, we have about 80% of all crypto transaction volume, centralized transaction volume is part of Beacon. So think finance, Coinbase, Kraken, OK, xblockchain.com, crypto.com, Ripple.

But then fintechs like Robin Hood and Stripe and PayPal and we basically married them with about 70 global law enforcement agencies who are flagging illicit proceeds and sending out real time alerts. Think Beacon Lighthouse, right? And the exchange gets these alerts and before those funds can move through the exchange to that off ramp, they're being blocked and then ultimately working with law enforcement to seize back. So it's all about speed. And that's the power of this technology, right?

Like the promise of crypto is cross-border value transfer at the speed of the Internet. We can now move larger amounts of funds faster than ever before, for good, for humanitarian aid, for remittances, for payments. And yet bad actors are trying to do the same thing. So we need to move as fast as they are. That's yeah. That's really interesting. I also had a question too, in terms of when we're talking about law enforcement disruption and how governments are kind of approaching this, the issue of ransomware.

What do you think about sanctions? Like how effective have those been and especially with kind of your your own background dealing in that area? Yeah, Look, I, I think sanctions are one tool in a larger toolbox of national security tools that we should be implementing against ransomware gangs, against these scam centers, against Iran. You know, when I was at at Treasury, we were talking almost constantly about measuring the impact of sanctions. And it's not always easy.

But I would say that sanctions, sanctions need to be deployed against these groups and the states that sponsor them or allow them to operate, you know, pretty much unfettered. But but we got to mix it with other tools. And to me, the most powerful one that we have today that we're not using effectively is offensive cyber. If if North Korea can steal 1.5 billion from bibit or 285 million from drift, we should be stealing it right back and more. And you know, it's interesting. I mean, we're in this really interesting moment in human history where the private sector holds all of the data and the public sector has all of the authorities. And our job is to provide the public sector with all the data that they need to go after bad actors. But I think it's also important to empower the private sector to go after bad actors similarly to the way we think about public sector.

You know, around the American Revolution and the, and the War of 1812, we had these things called letters of Mark that allowed us to go after pirates on the high seas. I want cyber letters of Mark to allow us to go after these types of bad actors who operate on blockchains and in the digital space today. So I think that sanctions are a really powerful tool, but combined with law enforcement authorities, national security capabilities like offensive cyber and, you know, a host of other types of things, I think we're more, I think we're starting to see the right, like the, the right level of response here from our government in the US, from the White House. But there's still more work to be done for sure. Yeah, definitely.

Absolutely. OK. Well, is there anything else you want to mention either about kind of, you know, just cryptocurrency in general? Yeah, you're in my sweet spot. I'll talk about all of it. I think, Yeah. I mean, I think we covered a lot. Yeah, I think we probably covered a lot, but yeah, I don't know anything else, any other areas. I mean, obviously the ransomware piece is someplace that you're very focused and I, I feel like we covered that pretty well. But yeah, no, I I felt pretty good. Yeah, awesome.

Well, thank you so much, Arie. It was really nice to, you know, get some insight from you about what's going on in this space. I really appreciate you coming on. Hey, thanks so much for having me.