Money Stuff: Coinbase Got Hacked a Little

Banks face various cybersecurity risks, of which the main ones might be:

1. If criminals gain access to a bank’s computer systems and steal customer personal information — names, Social Security numbers, account balances, email addresses — that is very bad. The hackers can use that information in various nefarious ways. They can send the customers emails to promote frauds. They can do social engineering attacks on the customers to try to get them to hand over money. They can threaten to publish the information if the bank doesn’t pay them a ransom. They can — I swear this is a real thing — file a whistleblower complaint with the US Securities and Exchange Commission if the bank fails to promptly disclose the hack.
2. If criminals gain access to a bank’s computer systems and steal the money, that is very, very, very, very, very, very, very bad. Like, really quite a lot worse than stealing the email addresses! The bank has a very important obligation to guard its customers’ email addresses, but it has an absolutely existential obligation to guard the money. 

There are a few cases of hackers getting into the bank and stealing the money, but not many, and not that much of the money. I used to joke that it is weird that hackers keep breaking into banks to steal email addresses, when the banks also have money, but of course it isn’t. It’s not that the hackers don’t want to steal the money; it’s that they can’t. The banks guard the money much much much much much more carefully than they guard the email addresses. They guard the email addresses very carefully! But the money is a whole different level.

Meanwhile, historically, cryptocurrency exchanges faced their own cybersecurity risks, of which the main ones were probably [1] :

1. Hackers were constantly stealing all of their crypto,
2. Unless the executives of the crypto exchange stole it first.

It used to be that the way you hacked a crypto exchange is that you walked up to the chief executive officer of the exchange at a crypto conference, and you said “hi I am the wallet inspector, I need to inspect your crypto wallet,” and he would say “sure we keep it all in one online wallet and our password is password123,” and you would send all of the crypto from the exchange’s wallet to yourself, unless, as sometimes happened, the CEO had already emptied the wallet. The idea of hacking into a crypto exchange to steal email addresses was insane: There was all that crypto there!

Obviously guarding the crypto is pretty existential for a crypto exchange too but, you know. Young industry, lightly regulated, move fast and break things, etc.; some exchanges were not particularly good at it. I used to joke that the fate of all crypto exchanges was to be hacked and lose all their customers’ money.

But those days are long gone, and now big crypto exchanges are mature and regulated and careful and much more attuned to the existential risk of losing all the customers’ money. And so Coinbase Global Inc. was hacked, but in the normal, stealing-email-addresses way:

Coinbase Global Inc. said hackers bribed contractors or employees outside the US to steal sensitive customer data and demanded a $20 million ransom, in one of the most high-profile security breaches of a crypto trading platform.

The largest US crypto exchange said it won’t pay the ransom and estimated the incident could cost the San Francisco-based firm up to $400 million to remedy.

Criminals had offered cash to Coinbase customer support agents to copy customer data like names, addresses, account data and government ID images, the exchange said in a statement on Thursday. The attackers planned to use this data to pretend to be Coinbase and convince users to hand over their crypto, while demanding ransom from the exchange to cover it up.

Here is Coinbase’s SEC filing, which reports that “the Incident did not involve the compromise of passwords or private keys, and at no time were any of the targeted contractors or employees able to access customer funds.” Instead, they took identifying data, and the risk is “that the compromised information could be used in social-engineering attempts” and that “retail customers [might have] previously sent funds to the threat actor as a direct result of this Incident,” which Coinbase says it will reimburse.

Good for Coinbase! The lesson here is that if you are really dedicated to hacking Coinbase, you can bribe a customer service employee, get some customer email addresses and use them for scams and social engineering projects. But you can’t bribe the person with the keys to give you Coinbase’s crypto. The crypto industry has grown up.

One reason to make a lot of money is to get a good spot on the league table of rich people. How important is this reason? I cannot speak from personal experience, and it is possibly less important than considerations like “$100 billion buys a lot of goods and services,” but I get the sense that it’s pretty important. The people who make billions of dollars tend to be very competitive, and surely at least some of them care about their precise spot in the rankings. Being the richest person in the world does seem cooler than being the second-richest person on the world, though I doubt that your consumption basket changes much between those two spots.

And so you might imagine that the design of the league tables could motivate behavior. We have talked a few times around here about the concept of a “billionaire,” which is (1) widely desirable and (2) somewhat imprecise. A billionaire includes someone with $1 billion of cash, but it also includes a lot of people who own a stream of cash flows with an expected present value of more than $1 billion. But not all of those people. If you make $80 million a year podcasting, your expected future earnings are arguably worth $1 billion today, but that won’t get you on the billionaire lists. But if you sell a 10% stake of your podcast for $100 million, that will get you on the list. There are various tax and diversification advantages to selling that 10% stake, but there is also the fact that saying “I’m a billionaire” is cooler than saying “I make $80 million a year,” cool though the latter is. Presumably some people are motivated to sell stakes in their businesses by that somewhat arbitrary feature of the rankings. [2]

And so, if you are designing the league tables, you might take this into consideration, and try to construct the league tables using rules that (1) are defensibly accurate, in the sense that your list of 50 Richest People plausibly reflects the 50 richest people (and in the right order), but also (2) motivate socially desirable behavior. I don’t know precisely what that looks like, but here’s one suggestion from Bloomberg’s Devon Pendleton and Jack Witzig:

To understand just how successful Warren Buffett has been during his six-decade run atop Berkshire Hathaway Inc., consider this: Even his $167 billion fortune doesn’t come close to capturing his wealth and influence.

Over the course of nearly 20 years, Buffett, 94, has gifted Berkshire shares worth more than $60 billion at the time of donation. That stock would now be worth some $230 billion, according to Bloomberg calculations.

Put another way: Had the Oracle of Omaha held onto his stake through the years, he’d have a net worth of almost $400 billion as of April 30, according to the Bloomberg Billionaires Index. That’s $67 billion more than the fortune of Elon Musk, the world’s richest person.

Charity-adjusted billionaire rankings! Why not? Generally speaking your spot on the billionaire rankings is based on your net worth, which is to say (1) how much money you have made minus (2) how much money you have lost and/or spent. When your stock goes up, your ranking goes up. [3] When your stock goes down, your ranking goes down. When you spend money on a sandwich, your ranking goes down (infinitessimally). When you spend money buying Twitter, your ranking might go up (if Twitter is worth more than you paid for it) or down (if it’s worth less than you paid for it), and the people doing the rankings will have to use some judgment.

When you put a bunch of stock into a revocable trust, your ranking does not change at all: Elon Musk doesn’t own any shares of Tesla, for instance (his trust does), but everyone understands that that is a minor technicality and those shares count toward his wealth. When you title your stock in the name of your spouse or children, the rankings might or might not look through that and say “ehhh that counts toward how rich you are.”

When you irrevocably donate your stock to charity, you no longer own it in any legal or practical or economic sense, but should you still own it for league table purposes? Would that incentivize more donations? “You can give away all your money and still be rich (in our rankings)”? For consumption purposes that is not as good as actually being rich, but for competitive purposes it might be. And “you can give away half your money and still be just as rich (in our rankings)” is really good: You get all of the consumption benefits of having $167 billion, which is all you probably need, and all the competitive benefits of having $400 billion, which is even better.

The US dollar is the global reserve currency, and a lot of people around the world want to hold dollars for various reasons. The market for dollars is mostly pretty efficient, though, so the price that all those people will pay for one dollar is generally right around one dollar. If I offered you a dollar bill, you’d probably pay me about a dollar for it. If you live in London, perhaps you’d pay me £0.75 for it, but that’s not a particularly great opportunity for me; £0.75 is worth about a dollar.

There are, however, some people who have dollars that are worth less than $1. These people are most classically drug dealers [4] : You get some drugs, you sell them to users for cash, you have a lot of cash, you put a million dollars in a big sack and go to a bank to deposit it, the bank teller says “where did you get this cash,” you say “dru—I mean it was in my grandmother’s attic,” the teller says “hmm it smells like drugs,” you say “huh that’s weird I put it in a different bag from my drugs,” the teller says “wait right here for a minute,” and you are tackled by six cops and go to prison. [5]  The $1 million in your sack was worth considerably less than $1 million to you: Rather than buying a Lamborghini (good), it bought you a long prison sentence (bad).

You can, if you are a drug dealer, generally do better than that. Instead of your cash having significant negative value, you can find someone to “launder” it into the sort of money that won’t get you arrested. The basic idea is that you take $100 of drug cash and turn it into $X of legitimate income from, classically, a laundromat or nail salon or restaurant or lucky day at the casino or online media company. And then you can keep $X in a normal bank account and spend it on normal stuff — a house, a Lamborghini — without getting in trouble. The drug money has been turned into legitimate money. X is considerably less than 100, though. Your drug dollars can be turned into regular dollars, but each drug dollar buys only 50 or 70 or 80 regular cents.

And there are people who specialize in money laundering: They don’t deal drugs or steal crypto or otherwise commit the underlying crimes; they just help the criminals launder money. Some of them probably do this on an agency basis: They work for a drug cartel, clean up its money and get paid a fee. Others do it on a principal basis: They pay, say, 70 cents on the dollar for the criminal’s money, and then tackle the problem of turning it into clean money for themselves. If they can buy $1 of crime money for $0.70 and turn it into $0.80 of clean money, their profit is $0.10.

Meanwhile, there are some people who would pay more than $1 for a dollar. These people are most classically citizens of countries with currency controls that prevent them from buying dollars freely. For instance, notes the Wall Street Journal:

China restricts its citizens from buying more than $50,000 a year in foreign currency. As a result, many Chinese turn to black-market money exchanges to move the equivalent of tens of billions of dollars out of China, according to estimates.

If you are a money launderer, obviously you should find them [6] : If you can buy a dollar for $0.70 (from a drug dealer), and sell it for $1.25 (in yuan, to someone evading Chinese currency controls), that is strictly better than turning it into $0.80 or even $1 of clean money. It’s possible that you have to clean it as an intermediate step — like, buy a dirty dollar for $0.70, turn it into $0.80 of clean money, and then sell that $0.80 to a Chinese national for $1 — but you might not (the Chinese citizens might be fine with drug cash), and even if you do, that is still much better than you would do without the Chinese citizens on the other side of the trade. You are doing money crimes anyway; you might as well capture the entire money crime bid/ask spread.

Anyway that quote is from a terrific Journal article about people allegedly doing it:

Sai Zhang, who left China for the U.S. on a student visa, took up the money-exchange business in Southern California, federal prosecutors allege. Zhang, who has denied wrongdoing, allegedly tapped into the surplus of American dollars held by the Sinaloa cartel to meet the cash demand of local Chinese nationals—making money on both sides of the trade. 

And:

Chinese money-laundering operatives in some cases open dozens of bank accounts at multiple banks, using counterfeit passports to disguise their identity or recruiting local business owners and students. They charge traffickers 1% to 2% on the dollar, undercutting competitors.

One or two percent! I cannot really claim to be an expert in the money laundering market, but my impression is that the normal commission percentage is in the double digits: This is risky difficult illegal work, and nobody is going to do it for 1%. But these guys are “making money on both sides of the trade,” which means that they can charge much less than people only doing one side of it.

I feel like this is increasingly a sports gambling newsletter? Like a decade ago, you might have thought “sports gambling is one thing, and capital markets are another thing, and those things are very different,” but that seems a bit silly now. There is a ton of overlap in skills and techniques and personnel between sports gambling and “traditional finance,” and there are things (event contracts, meme stocks, memecoins, crypto generally) that somewhat blur the lines between them, and for like 20 minutes this year it looked like you could bet on the Super Bowl in your Robinhood brokerage account. “An emerging asset class,” Robinhood called sports betting at the time, and I wrote:

The link between finance and real economic activity was always indirect and imperfect — lots of financial markets activity has always been speculative and irrational — and it is increasingly inessential.

All of it is betting on sports. Sports are sports, and entertainment is sports, and politics is sports, and crypto is sports, and stocks are sports. 

That last sentence was a bit imprecise. “Stocks are sports,” I wrote, but of course what I meant was “stocks are sports betting.” Similarly, I wrote that “sports are sports,” but that is also not quite right. Sports were sports back when stocks were the present value of future earnings. Now sports are sports betting; the games are now the substrate for a gambling economy more than they are straightforward athletic competition and entertainment.

Anyway two extremely famous baseball players — Pete Rose and Shoeless Joe Jackson — were banned for life from baseball, and have been kept out of baseball’s Hall of Fame even after their deaths, for their involvement in gambling. As baseball has gotten more into encouraging gambling, this ban has become increasingly weird, and this Tuesday it more or less ended, as the commissioner of Major League Baseball “removed Pete Rose and other deceased players from MLB’s permanently ineligible list.” Here’s a Wall Street Journal article quoting some objectors, including the son of Bart Giamatti (the former commissioner who banned Rose) and John Dowd (a lawyer who wrote the report finding that Rose bet on his team’s games):

“If this happens, baseball will never be the same,” said [Marcus] Giamatti, an actor best known for his role on the TV legal drama “Judging Amy.” “How can any fan ever trust in the purity of the game again if you’re never sure if the integrity is there? That’s what troubles me the most—and I know that’s what my father adamantly fought for.” ...

“Bart knew that the game of baseball was precious to America at all levels,” Dowd said. “It is in the bone marrow of the American people. Thus, the need, dead or alive, to protect its integrity. Without the integrity of the game and its processes, free of loopholes, there is no game.”

Yes but without gambling on the game … is there a game? I suppose that, to the extent baseball games exist mainly as subjects for gambling, it is even more important that players don’t bet on baseball, but that is less about “the purity of the game” and more about the integrity of the betting. Gambling on sports is a big business, and insider trading on sports undermines that.

I wrote yesterday about the problem facing Tesla Inc., which is that it wants to give Elon Musk back the giant slug of executive stock options that it gave him in 2018 and that a Delaware judge took away last year, but giving him the same options today — when they are worth something like $94 billion — would have horrific accounting consequences for Tesla and horrific tax consequences for Musk. I half-jokingly suggested one way to fix this problem, which is to drive the stock price back down to 2018 levels and then give him the options to incentivize him to fix it. This is, to be clear, a terrible idea, but also, uh, like, a partially accurate description of what seems to be happening?

There is probably a better solution, which reader Thomas Clay emailed me to propose. The two essential elements of this solution are:

1. Giving an executive stock as compensation for his services has various bad tax and accounting consequences, but paying stock in a corporate finance transaction is generally nicer. For instance you can generally structure an all-stock merger in such a way that (1) the transaction is not immediately taxable to the recipients of the stock and (2) the cost of the stock is not an expense on the issuer’s income statement. 
2. Elon Musk starts lots of new companies, and has a history of having some of the companies he controls buy other companies he controls at prices that, let’s say, he has some influence over.

I think that sufficiently describes the solution, but just in case here’s Clay’s email:

Is there a legal or tax reason why Tesla couldn’t buy a private company owned 100% by Musk through issuing $94b of TSLA stock in order to secure his future services as CEO? I assume the board and shareholders would wave it through. I assume it could be done as a tax-free share exchange, and Tesla would book essentially all of the acquisition price to goodwill.

The main objection to this approach a year ago would have been “someone will sue, and a Delaware court might have questions about the entire fairness of that acquisition.” But now Tesla is incorporated in Texas so who knows!

I say “who knows,” but actually yesterday the governor of Texas signed a new state law making it harder to sue a company or its board for breaches of fiduciary duty, including by requiring proof of “fraud, intentional misconduct, an ultra vires act, or a knowing violation of law” and requiring at least 3% share ownership for derivative lawsuits. So in practice if Elon Musk incorporated a new company to play Path of Exile 2 for him, and then sold it to Tesla for $94 billion in stock, that would be … fine … ? … ??? … ? Something to think about.

401(k) Giant to Allow Private Markets Investments in Its Retirement Portfolios. Partners Group Will Urge Trump Officials to Bless Private Equity in 401(k)s. Saks Bond Suffers $1 Billion Loss Before a Single Payment Is Made. US poised to dial back bank rules imposed in wake of 2008 crisis. German regulator ‘bewildered’ by US plan to scrap audit overseer. Can Bill Ackman create a ‘modern-day’ Berkshire Hathaway? Commerzbank Says UniCredit Didn’t Register to Vote at Meeting. UnitedHealth Group Is Under Criminal Investigation for Possible Medicare Fraud. Extortion Gangs Overrun Colombia’s Biggest Oil-Producing Region. ‘Reverse Yankee’ deals hit record as US companies flock to euro debt market. Terrorists Continue to Pay for Check Marks on X, Report Says. Elon Musk’s AI chatbot shared ‘white genocide’ tropes on X. Promoters of $100 Million NJ Deli Get Prison Time for Fraud. (Earlier.) Ben & Jerry’s Founder Arrested at Senate Hearing After Protesting War in Gaza.

If you'd like to get Money Stuff in handy email form, right in your inbox, please subscribe at this link. Or you can subscribe to Money Stuff and other great Bloomberg newsletters here. Thanks!