Bits + Bips: How a Fake Podcast Invite Nearly Hacked Laura Shin

Transcript

Today we want to start with something contemporaneous that just happened uh with regard to Unchained to explain to people exactly how things are still working in crypto and how to keep yourself safe, which is somebody tried to spearfish Laura earlier today. So Laura, can I have you tell the story of what we were talking about before we went live and what happened? Yeah. So, it wasn't today, it was last week, but I had agreed to do a podcast with somebody and when I logged in, the link wasn't working and I was getting this notice saying that I had to download some software. And so, it's so funny because they did actually convince me to

download the software and I even got to the point where I even executed a terminal command. And here's the crazy part. the whole time like if you look at the screenshots of my conversation with this person the whole time I kept saying oh this is how people get hacked and I because initially I kept refusing to do all the things and I have covered hacks I've covered you know fishing attempts I've covered just all kinds of scams in crypto I was I think the first person to write about SIM swaps back in 2016 and even before crypto I covered personal finance I covered identity theft I covered so much about scams and social engineering. Like I interviewed the main social engineering people well before I

ever got into crypto. So it's just so funny because I keep saying to this person, oh but you know I like I would refuse and then and then I would be like this is how people get hacked. But so here's the thing that like now I realize okay here is how this person got me to override all of my internal bells and all my learnings. um they said, "Oh, well, it's a special crypto podcasting platform." And they sent me the link to the X account. And I looked at this, you know, X account, and 153 people that I follow are following this account. And I was like, "Oh, I guess it's a crypto podcasting platform I've never heard of." And so then the notion that like

maybe I actually needed to download some special software was no longer so strange. But I also remember that I had this moment where I was like, I feel like I should tweet to ask my followers if this is, you know, like I but then because this person kept messaging me do that and so I just kind of like didn't do these things that floated through my head. Um and then when when the software of course didn't work um then he was like oh well there was these like terminal instructions and even that I was like what the hell? Like I just was and I think I said no again multiple times but then they were like no no no no I swear like all these people use it and I think they again used the ex

account. So anyway point is the good news is I don't think I lost anything. I didn't have like I have to um there there's a lot of things I have to do because I had to reset my computer to factory settings. I had to take it offline. Like there were just a lot of things I had to do. And so even today I'm still downloading apps that I use. I'm still logging into them. Like there's I'm still changing passwords. There's kind of like a lot that's going on. Um but yeah, it's just funny and embarrassing because like I knew all the things. I knew I had so much knowledge.

I'm literally trying to teach the guy about social engineering and and how you know and anyway. So yeah, I still I still didn't listen to myself. And that's exactly how social engineering works. It's exactly it. Praise upon your desire to be a nice person. And oh, and by the way, you know, this quoteunquote podcast, like of course, you know, I looked it up on YouTube and yeah, it's a legit podcast, but is that account that was trying to get me to do all those things? Were they really connected to, you know, that group? Probably not. In fact, like 99.999% not. So, um, yeah. Last thing I'll say is just Seal 911. They've been on the show so many times. Everybody always

talks about them, but they truly are an amazing resource and they helped me, you know, over the weekend and um yeah, they yelled at me a little bit too, but I deserved it. So that's that's basically this the story. >> No, and I I think you raised some interesting threads in there, which is if you think about like this is something the banking industry struggles with as well, right? If you think about the threat vector of social engineering attacks, even people who are informed about how they work do fall for them because the attackers are trying to prey on you at the exact moment where your mind is occupied with other things and you are not fully aware. And that's one

reason they always try to create time pressure like we need you to log in for this podcast. Oh, the cuto off is coming at 400 pm. Oh, it so rule number one for anybody when you have somebody on any form of social communication or even texts applying time pressure to you and you're not certain about something, the first question you ask is, is this truly catastrophic if I don't do it? And if the answer is no, just don't do it. It'll be fine. Like, let that go. Number two, from some of the good security researchers, I have been told the easiest rubric to not fall for these things is have a set of rules that you never ever ever violate ever. Like, sorry, I don't

download programs or click links like at all. If that is what your podcast requires, I cannot do it. Go tell everybody right now. The answer is never. And then, by the way, always blame your infosc people. You, if you want to be a nice person, you don't need to own this decision. You could be like, I'm not allowed to. I don't have the authority to like punt it, but like don't ever for that reason because once you create a rule with yourself that you're internally consistent on that you cannot violate, it makes those tactics worse work less well. Three, one thing I do individually because like there have been a bunch of compromised like Telegram attacks recently where I have people trying to get me to click on things and download things and join meetings and whatever. Just always put

the link into an AI model and ask is this a scam? You'd be shocked at how good they are at being like yeah don't trust that like that's definitely never real and don't copy the text. Copy the actual link and put it in there and very frequently they will shut you down. But like I want to raise one other thing that I was saying that Rahm reacted to. Rahm, I was telling people part of the way that I've become semi-immune to these attacks now is I looked at the value of self-custody compared to the risk and I hold all of my crypto in ETF float now. Like what would you have to say to that? What do you advise people at?

>> Yeah, 100% 100%. You know, ETFs are safe, secure. You've got the implicit backing of BlackRock and their net equity. uh you get liquidity, you get cross margining, you get convenience of an integrated statement. Uh so yes, uh the vast majority of people should be using ETFs to manage their digital asset exposure. >> Is it only Black Rockck? I I digress. Um anyway, you know, I I think there's a couple other hygiene things you can do to the extent that you you know, want to have self-custody that that's fine. um, you know, really advise people to use a hardware wallet where you can, and there's some amazing ones out there. I'm gonna admit something to you guys. Never told anybody before, but uh, I got

hacked. I hacked a couple years ago. It was a Friday. Had a couple beers and, uh, the good news was that I kept good hygiene. I put most of the stuff that was that I wanted to on that hardware wallet. But I was messing around, clicked on something, and they stole my Snoop Dog NFT. And uh you know it still hurts to this day. Um but it was it was I'm glad it happened because it was such a stark reminder like you're in the big leagues, you cannot mess around. I also think that this is going to get much worse going forward on the social engineering. Um we need solutions, we need tech solutions. You know, every time you're on the anytime you're you're you know, your voice is out there,

they've got your voice, they've got your likeness. It's going to get much much tougher. And so while I do think security across crypto is actually going to exponentially improve as we start finding age-old vulnerabilities, I do worry about the the social engineering attack vector. That's why I'm bullish on like proof of human type solutions out there that that can really identify humanness. So lot lot to take away from this one guys. Last thought on that, the read through could be negative for crypto brokerage firms because ETFs are an implicit form of competition because the security benefits they confer.

Well, yeah. With an ETF, you're outsourcing a lot of the security, the cyber. Uh I'm seeing this in real time right now with my transition and it's there there's, you know, when you look at crypto, decentralization is something we all believe in. We all think is wonderful and and and it's really important that that persists, but that doesn't mean intermediaries are going away. And the question is is do you want to pay them? Do you want to hand over some of that sovereignty or some of the value that they can give you? And for many people the answer is yes. And that's fine. Um that I think that's what we're talking about here.

>> I mean I think for anybody prominent like you know where you have a public persona that is associated with crypto it makes a lot of sense to have somebody else in charge of your crypto. And so that's why yeah like for me like I don't know why they were targeting me. Maybe they don't know that I just don't really even have that much. Um, but yeah, it uh I would say, you know, I I know people who, you know, they'll like, well, I I don't I don't know how public they are about this, so I don't want to get into too much detail, but but there are people that you all know in crypto who go to extremely great lengths to not have anything, even if their face is

known, they try to not have anything with their name that would identify like where they live or what other accounts they have, like, you know. So just there's so many ways uh you know to to kind of get around this like you don't have to just become a hermit but these are things that if you are publicly affiliated with crypto you should definitely be thinking about >> and I think that has broader implications Laura to bring this all the way back around to where you started with fraud and identity theft at large because these same tactics are going to be happening with banks right with payments companies with you get that phone call that is using the perfect AI voice of your kid like, "Hey, I had a car crash. I need money, right?" Like,

we've all heard these stories. And I would just remind people, we're in a threat space where this stuff gets more intense and they're going to try to use your own emotions and like behaviors against you. And awareness really matters. Recovery matters. But this is one area where as Rahm was saying there's going to be a market opportunity for people who figure out how to interdict these things as well. Like that might be a positive use case of AI for the world. But we will see. So speaking of interdictions, we are coming up on the 250th anniversary in the United States and uh I do still think there's a strong policy response that we should see which is to allow the private sector to recover to recover these

assets. Um, right. >> And so I'll keep speaking about it till I'm blue in the face, but give me the privateeers. >> So, whoever recovers Laura's money that was lost in this crypto, I >> I don't think I lost any, >> if any. >> We'll have you on this show to explain how you did it. There we go. We could promote our privateeering right there. But no, joking aside, Laura, we were talking about that. I just think it's good for the world to occasionally get the reminder on security and like how sophisticated these schemes are and what can happen. So, thank you very much for explaining that. Remember everybody, assume the account is compromised. Do not click the link.

>> Yeah. Well, thanks for inviting me last minute. Just pop in and talk about my my tail. Uh which yeah is is definitely a lesson for everyone. >> It it really does matter though. like at every incremental gain we get here like I want to remind people of the scale of this problem is tens of billions of dollars are scammed like annually just out of America. If you look at like the taxonomy of the pig butchering scammers who were operating out of Cambodia or like some of the Russian scam farms and things like that, this is a very severe problem that's destroying lives. So if you're in this space at all, you need to think about this. You need to act on this stuff. You need to take it

seriously. >> Yeah. >> All right. >> All right. Well, uh, have a great show. Thanks so much, and I will catch you later. >> If you like this segment, please like, subscribe, and tune in every Monday at 4:30 p.m. Eastern time. I'm Austin Campbell, the host of Bips and Bips, along with my friends Ram Alawalia and Chris Perkins, and our slate of exceptional guests. Every week, we're going to discuss macro, crypto, and the collision of worlds, covering topics that move markets and shape the financial landscape.

If you hold crypto on your phone, your biggest vulnerability isn't your wallet. It's your carrier. AT&T, Verizon, and T-Mobile have been breached again and again, and SIM swaps are still one of the easiest ways for attackers to drain accounts. That's where Cape comes in, America's privacy first mobile carrier. Same premium service, but Cape rotates the identifier on your SIM every 24 hours, deletes your call and text metadata after a day, and protects against SIM swaps with a 24word recovery phrase that only you control. You also get two middle toend encrypted secondary numbers for banking and signups, so you stop handing your real number to every

app that asks. Go to cape.co/chained co/chained and use code unchained for 33% off your first six months.