Has cybersecurity become a myth?

Move over 10 Things I Hate About You.

We’ve found 4 Things We Hate About Your Vulnerable Cloud Infrastructure, starting with… 

1. How to lose $6B in 20 minutes

Binance, the world’s biggest cryptocurrency exchange, indeed lost a historic chunk of crypto assets in a ~20 minute stretch after hackers broke into the platform’s ‘signing infrastructure’ last Thursday.

The thieves then swapped the stolen stablecoin (tethered to a reserve asset like the USD) which they knew would soon get frozen, in favour of other decentralised coins harder to track and suspend.

But here’s the Intrigue: first, this wasn’t some pack of nerds in a basement, but (according to the FBI) North Korea’s own Lazarus (or TraderTraitor) hacking unit, which okay might actually still be comprised of nerds in a basement.

And as we flagged yesterday, this hack is on-brand for the regime, which desperately needs cash to stay afloat, and specifically prefers crypto because of the way it helps circumvent all the international sanctions it’s accumulated for its nukes and threats.

So its hackers yoinked $1.2B in 2024, $1.65B in 2025, and now $6B on a Thursday.

The second layer of Intrigue™ is in the crypto itself: after news of the attack spread, rattled users shifted another $4.7B away from Binance, but if the North Koreans could hack a paranoid platform like Binance, it’s not clear your bitcoin is safer anywhere else (other than perhaps just by virtue of hiding in a smaller target).

Oh, and the third layer? North Korea just denied it was responsible for the hack, but Pyongyang once signed a denuclearisation treaty pledging never to obtain nuclear weapons, and yet here we are.

Anyway, the crypto sector has avoided a crash for now thanks to Binance covering the losses, so maybe it’s like Nelson’s victimless crime (“like punching someone in the dark”). But what happens after the third or fourth AI-powered mega-hack?

2. Sleepless in Kyiv 

Then on Sunday night, millions of Ukrainians received alerts about nuclear, chemical, and even street fighting dangers via the official air-raid alert app folks use to prepare for Putin’s nightly attacks. 

But the fact some of the alerts were written in Russian rather than the usual Ukrainian triggered everyone’s spidey sense until Ukraine’s Air Defence Forces quickly confirmed there’d been a hack (the app was then back online by Monday). 

Shortly thereafter, however, Russians started getting weird alerts from their own warning app. And while legacy outlets duly cleared their throats, adjusted their spectacles, and politely reported that these were (ahem) “expletive-laden” fakes, we'll give you an actual example (just censored to not offend your corporate firewall):

• “Sh!t going down! Don’t worry! Nuclear warheads have been launched at all Russia’s swamps! Urgently stock up on food for 3 weeks and hide in your ****ing basement or it’ll tear your *** apart!”

But here’s the Intrigue: while there’s no direct attribution to confirm these were Russo-Ukrainian hackers trading blows, that’s our assessment. And sure, those kinds of messages might sow some initial panic, but the strategic aim is really to undermine the public’s trust in its government and any official comms. In Ukraine’s case, it’s also an immediate retaliation to deter the Muscovites from trying that stunt again.

3. Some like it hot

Do we really need internet fridges?? We doubt it even more after the latest hacks on supermarket refrigeration across Belgium, Ireland, the Netherlands, Estonia, Finland, and Sweden. RIP Ikea meatballs, gone but not forgotten.

How? Hackers again switched the appliances to a ‘defrost’ setting, raising the internal temperatures to as high as 55°C (131°F) and spoiling millions worth of food. It’s a redux of what hit French supermarkets last month, while the US is also investigating familiar freezer failures at six military sites back in August.

But here’s the Intrigue: absent any clear attribution (yet), a lead suspect would be Russia given its motive (divide, distract, and deter), capabilities (NotPetya), and track record (arson and sabotage across Europe).

The Kremlin would also see a chance to test NATO reactions given a serious enough cyberattack could trigger the alliance’s Article 5 mutual defence clause.

Sure, there’s a ransomware theory too, though that doesn’t fit the scattergun targeting, lack of discretion, or absence of any ransom reports.

In the meantime, ask yourself if you really need that internet-toaster, or if it’s just another way to charge you more while hocking your data to the highest bidder.

4. Clueless 

The top brass over at Japan’s GMO Internet Group bowed low at a news conference on Monday as they apologised for a massive cyberattack on the firm’s cloud services hitting tens of thousands of users (including a major forex platform). 

GMO says a ransomware group was demanding a cool $51M, and executed the hack after the firm refused to pay. So now, as penance for not heeding cybersecurity advice from 2024, four top execs now face a temporary pay cut of 20-30%. 

But here’s the Intrigue: GMO has interests across web-hosting, cloud services, robotics, AI, and (lol) cybersecurity, so when it gets hit, there’s quite the blast radius.

In this case, GMO’s forex link has spooked creditors given a) the potential downstream liabilities, but also b) the hit to GMO’s financial tech division, a major revenue driver. That’s why GMO’s 2031 bond spreads just widened 50bp in a few days.

Anyway, gone are the days when a bank’s worst nightmare was an antitrust investigation or an Ocean’s Eleven-style heist. As GMO chief Masatoshi Kumagai put it, “Before, cyberattacks were like a handgun. Now, they’re a machine gun.”

Sound even smarter:

• Hackers reportedly just stole 23 terabytes from Russia’s official stats agency, including information around the aggressor’s wartime losses. 👀

• While we’re in Russia, the direct Ukraine talks we foreshadowed are now confirmed for Abu Dhabi next week, while parallel talks with Europe explore possible security guarantees for Ukraine. We still sense Trump wants something signed on the margins of APEC or the G20, though we continue to doubt it would stop Putin from just re-arming and re-attacking when ready.