The Banxico Heist and a High Wire Act of Solo Podcasting

Speaker 1: Jordan here recording live from Mexico City. I just got back from a very rainy boat ride during which a band played La Bamba. I mentioned this so I have an excuse to play the audio. Highly recommend. Anyways, I'm only here for a little bit on the way back to record with Scott, but I'm here. So I figured we'd start off this episode with a story set right here in Mexico City about a bank. It's 04/17/2018 and a bunch of bank transfers appear inside of something called the SPEI. SPEI is Mexico's electronic interbank payment network. It's been around since 2004. It's run by a thing called Bancica, which it'll come up later. SPEI is like a system for moving around money digitally. It's what lets you send and receive money between bank accounts. All of the banks connect to a central switch that routes the money between them. Once the transfer is accepted from SPEI, it is final. Funds arrive in seconds. They can be withdrawn as cash pretty much immediately. Banks connect to the SPEI through something called, this is intuitive, SPEI connectors. Those are pieces of software that prepare and signs this set of instant transfer instructions. Inside of the SPEI overseeing all of that is something called the central switch, which is a piece of software that validates and executes those money transfers. It's the central switch's job to look at and approve the format and signature of those transfers. The central switch just routes the money to the receiving bank. Now importantly, the central switch does not check anything to do with the accounts the money is being sent to or from. That responsibility rests with the sending bank. The switch is just a transit system. So if the bank says send money from account A to account B, the central switch is gonna do it. They are moving an amount of money somewhere. Which means there is inherent to this system a really intense element of trust. If the bank's connector software signs an order, the SPEI, that central switch, assumes that bank's order is legitimate, and it's gonna send however much money, and this is this is actually how this worked, wherever the instruction says to send, that assumption, that trust that the incoming orders were valid, that keeps those transactions blazing fast. It is also, and you have maybe already likely picked this up, a giant weakness in the design of this system. 04/17/2018, the first of what we're gonna call the phantom transfers appears inside of SPEI. They looked like normal transfers. Formatting was all valid. Everything was fine. They had the normal approved digital signatures. And so that central switch starts moving money between accounts. Pretty much as soon as these phantom transfers start occurring on the receiving account side, you can be sure some people started withdrawing that money. Cash is getting pulled out of ATMs across Mexico City pretty much immediately. People are showing up at, you know, ATMs and teller windows, they're taking money out of bank accounts, and so far nothing is really that weird about this. These are all small amounts of money repeated over and over again, but no one really knows at this point that anything is up. The trouble with this flurry of transactions across Mexico, and this is the crux to this whole story, is that the accounts that the money was being withdrawn from, like the sender accounts, did not exist. So what exactly happened here? The attackers in this hack didn't go after the central switch. That would have been harder and riskier and way more noticeable. Instead, they went after the edges, the software connectors that we talked about earlier, those third party software packages that banks used to connect to SPEI. At many institutions, these connectors were installed on servers sitting inside of corporate networks with horrible segmentation, meaning that once an attacker got into the bank's network at all, in basically any form, getting to that connector was pretty straightforward. From there, they started injecting those phantom transfer orders. Now, as far as the central switch was concerned, each order looked fine because the connector software at the banks had actually signed it. The digital signature said, this request came from bank x. Here is the account. Here is the destination. An SPEI says cool and deposits the money into the receiving account, assuming that somewhere on the bank's end, the sending account existed. And the catch was that those source accounts, they're made up. They never existed inside of the sending bank's ledgers. But the central system doesn't check the bank's records. The SPEI, and this is the big design vulnerability here, relied on the assumption that if a bank's connector signed a transfer, it must be legitimate. The accounts must all be legitimate, because otherwise why would the bank have signed it? The money must all be legitimate, and that set of assumptions cost Mexico hundreds of billions of paces. Getting phantom transfers into receiving, call them mule accounts, was only half the job. The other half was turning those numbers into physical pesos. The attackers, this sort of organized crime syndicate we're gonna get to, they had that part on lock. Banksico later reported that the money flowed into 836 accounts across 10 different banks in 97 cities, including some right here in Mexico City, and then show up the cash mules. People, some of which were recruited with the promise of a cut, others who were kind of coerced into doing this, we would find out in the years that followed, they they fan out, they go to branches and ATMs, and they start making withdrawal after withdrawal, often within minutes of one of these phantom transfers landing. By the time the bank staff spotted, oh, a lot of inconsistencies, the cache is gone. Meanwhile, on the server side of those compromised servers, forensics teams later found evidence of deleted transaction logs, altered files, basically just a bunch of attempts to mask the injection points, sort of an anti forensics to slow investigators down as they tried to figure out what was going on here and meanwhile the mules just keep taking money out. Inside the central bank, this attack is causing a lot of troubles, specifically for a woman named Lorenza Martinez, the head of Bank Seco's payment system. She'd been one of the architects of SPEI and this central switch design. She goes public and says, like, oh, the core of the system, the central switch, wasn't ever actually breached. Our stuff is fine. It was with the banks where the problem laid. Those connectors. But weeks into the crisis, very intense political and media pressure, she announces her resignation, 05/16/2018. A new guy, Alejandro Diaz de Leon, a governor, comes in and kinda becomes the face of the whole thing. He confirms those first fraudulent transfers had been recorded on April 17. He reassures the people that customer deposits aren't at risk. The banks themselves are gonna be, you know, bearing these losses for obvious reasons. They do a rule cap on withdrawals from new transfers at 50,000 pesos a day. Basically, they're just trying to slow down these cash mules while they start to try and fix the problem. For months, no one knew who had done this. That changed on May 2019. Federal police raided properties in Leon, Guanajuato and arrested Hector Ortiz Solarez, a man prosecutors called LH1. According to authorities, he was the leader of a group called the Bandidos Revolutions Team or BRT. They raid his house. They find, I have my luxury car stats here. 27 luxury cars, Porsches, Ferraris, Lamborghinis, a bunch of cash, a bunch of weapons, a bunch of electronics. You know, the standard spoils of a crew making tens of millions of paces a month through cybercrime. Court filings revealed a much wider network of crime. There's a whole big crew at the heart of this, a bunch of named associates including Ortiz's siblings, Cynthia and Juan. Prosecutors later said that the group wasn't just behind the SPEI theft, they were running a bunch of fraud operations. ATM jackpotting campaigns, parallel electronic transfer schemes that had nothing to do with this. In 2024, the federal prosecutor's office announced that 116,700,000 pesos in assets linked to BRT had been forfeited to the state. And if you follow those timelines, it is evidence of the fact that the government is still clawing back money from this hack years after the arrests. At the RSA conference in San Francisco in 2019, Mexican consultant, Jose Loza, laid out the technical anatomy of, like, what actually went down here. And he boiled the whole thing down to three big failures. First, the bank system had, like, a very flat network. Once an attacker got into the bank's IT system, there weren't really any barriers between, like, an ordinary workstation and those SPEI connected servers. Second, was connector trust. The SPEI relied on the assumption that any order signed by a connector was legitimate, and there there was no cross checking that occurred to see if like at bare minimum the source account existed. And the third big thing was like, you could take cash out pretty much instantly after the SPEI processed the transaction, which made it really really easy for mules to drain accounts before fraud teams could say, oh, this money does not and never existed. The math of that central switch was that actually was fine. All the cryptography worked. It was a design and architecture problem. The twenty eighteen SPI attack was like a big moment in bank security. It showed that you could have financial plumbing that was vulnerable not because of a very in the weeds exotic zero day exploit, but just because of design choices, speed prioritized over verification, and trust placed where it really shouldn't have been. By the end of that year, the SPI was back to basically normal operations, but the memory of this persists, and the controls are still a lot stricter, the audit's a lot more aggressive, and the banks a lot more cautious about that connecting software. I think it's about time for me to to get back out there. The rain has passed. The sun is out. We were in we were in a boat and it was coming down so hard that we were, we were using a bucket that we'd had beer in, to bail the water out of the boat. I hope you enjoyed this weird little story. In a moment, we'll be back in Canada with Scott where we're gonna chat it up, catch you in a second. Just kidding. Okay. Here's here's where we're at. So I'm back here in Canada. Scott, our dear pal, coincidentally also went on a trip to a totally different part of Mexico, also came back, and now has a, apparently very horrible respiratory illness, which, fun fact is kinda like the only type of illness, one of the few types of illnesses that you really can't, podcast with. If he had, if he had, like, a gut issue, I'd be like, mic yourself up. We're doing this. But, not being able to breathe makes it very, very hard to talk, so we can't we cannot pod. So here's the deal. I don't wanna leave y'all hanging, so I'm gonna I'm gonna share the stories with you here that I was gonna share with Scott. I appreciate that isn't the typical social vibe we like to bring. It's also not what I've typically done when I've made episodes solo where I go do an interview, we kinda do it doc style and edit it in. It's just gonna be me. I got notes in front of me. We're gonna make a game time call. I'm gonna put on this version of the show. If that's not your, particular brand of tea, I totally get it. Come back in the next one. It'll be back to normal. I promise. But for now, I've got some stories I wanna share with y'all. We're gonna we're gonna make it work, everybody. It's gonna be different and loose. I normally really tightly edit these things. I don't think that's the mood for this, but we're in it together. If you're still here, I appreciate it. I've got a few stories I wanna talk about. The first one was a story that a buddy that I was traveling with shared with me, and it concerns NASA, a Mars Climate Orbiter, and a catastrophic unit conversion problem that resulted in a, 100 plus million dollar piece of machinery exploding, in the atmosphere of Mars. It's a pretty wild story. Let's dig into it. September 1999 after nearly ten months on its way to Mars, the Nar Wow. This is gonna be this is gonna be good. Normally I would cut that kind of thing out but it's embraced this live stream energy. NASA's Mars Climate Orbiter broke apart and burned in the Martian atmosphere, a day that should have been like a really big triumph for the engineers and scientists and designers that worked on this piece of technology, turned into a very very very expensive lesson. Got my cat here in front of me, the one that normally screams in these episodes and he's being very quiet right now. So the Mars Climate Orbiter cost $125,000,000 to build, weighed 638 kilograms. It was this robotic probe they launched in 12/11/1998, and the point of the the orbiter was to study Mars weather, its atmosphere, how the surface of the planet shifted, had a second job which was to function as like a communications relay sending messages to, another, you know, surveyor that was gonna be coming, the Mars Polar Lander. At JPL in California, navigations teams worked in metric. The metric system, if you aren't familiar, they got millimeters, meters, newtons. I'm Canadian. I was talking about this with a British friend, and we're kind of the worst of both worlds here. So the way it goes, I'm sure you're all familiar with this, is pretty much the whole world uses metric with the exception of a small, small handful of countries, which just so happens to include The United States Of America and importantly Lockheed Martin. As Canadians, we are, as I say, kind of worst of both worlds. We're smug because we use metric, except we don't. Like, we use metric, we talk about how fast a car is going in kilometers per hour, but if you ask someone how tall they are, they're gonna be like, Oh, five foot ten. It makes no sense. Lockheed Martin Astronautics in Denver who built the craft provided the key acceleration data in, like, is it called English units? It's unintuitive, but inches, feet, pounds. The JPL engineers assumed that the data had been converted, and it had not. And what had come through, in pounds per second squared should have been in newtons per second squared. And that mismatch sent the spacecraft to the heart of the story fatally off course. The orbiter was quite literally lost in translation. So, before we dig into, like, the failure and exactly what happened, it's worth pausing on how units developed in the first place. So, for centuries, different parts of the world had to sort of rely on whatever system fit their local regional needs. In one culture, time would be tied to like a solar cycle. In another, it was tied to, say, a lunar phase Without the means to communicate globally or even beyond a very immediate region, scholars weren't comparing notes, and as a result, units and standards grew up in isolation. The world starts to get more collected, and you get this big push for a single universal system. During the French Revolution, there was the kind of the first steps towards what is today's metric system. These multiple standards were created in Paris to define, you know, the start of all this, the meter and the kilogram. German mathematician Carl Friedrich Gauss expanded this, added the astronomical second as a base unit. British scientists like James Clerk Maxwell and JJ Thompson continued kinda pushing all of this forward. You got the CGS system centimeter gram seconds. 1889, the General Conference on Weights and Measurements established international prototypes for this is a meter. So help you God, this is a kilogram. And we get the backbone of modern measurements. By 1946, this system which represents weight and time and distance, gets kind of cemented and approved internationally. In the decades that followed, we got stuff like Kelvin and Candela and Mole, other sort of base units for increasingly niche instances. Today, and this was kind of how the conversation with my friends started, the international system rests on, like, seven kind of key metrics. You got the meter for distance, the kilogram for mass, the the second for time, the mole for substance, the ampere for current, Kelvin for temperature, and candela for luminosity. The States, God bless them, will have none of this. If you go to The States, you're gonna quickly notice miles instead of kilometers. And, like, respect the game here. Pounds instead of kilograms, inches instead of centimeters. If you were raised on metric, it's a little weird. If you're from Canada, it's only half weird. The roots to this system and the reason I called it the English system earlier came from England. The early settlers brought over, like, customary measures, things like feet. Even as the rest of the world shifted to metric, The US held on to that system. A foot is 12 inches, a yard is three feet. In metric, there's sort of a clean divisibility by 1,000 centimeters in a meter, thousand meters in a kilometer. In 1975, Congress kinda took a crack at converting this. They they passed something called the Metric Conversion Act, making standard international units, meters, kilograms, etcetera, this sort of preferred US system or at least naming it as such. President Gerald Ford signed this. The law didn't, like, ban customary units, which I guess is good. It would be weird if it was like you you're how tall? You're going to jail, buster. But later pushes in the nineteen eighties, like, having like like, okay, we'll have a speedometer in the car that has both. None of that stuck. Businesses and people and even media just kept using the English system. America forged ahead, still embracing that same system. That reluctance lasted until this wake up call in 1999, with NASA at the heart of it when the climate orbiters, spoiler, absolute devastating destruction exposed just how costly this mismatch with the rest of the world system could be. A Boeing Delta two rocket carried the Mars Climate Orbiter into space on 12/11/1998. Everything's cool at launch. It's fine. A NASA review board later found that the spacecraft's thruster software was the culprit behind all this. Again, we have these two different kind of space programs working together. One program calculated the thrust of the orbiter, sorry, of the Boeing Delta two rocket in pounds. The other read the numbers, like a different piece of software was reading the numbers as though they were written in newtons, and no one caught that gap. Lockheed Martin engineers had been using pounds of force as with their standard. JPL assumed the data had already been converted into standard international units, in this case, metric. That mistake so it gets up there. It's got all of that mismatched velocity, and it sends the orbiter dipping too close to the Mars atmosphere. The thin air on the surface of Mars starts to tear it apart and pull it ever closer, and engineers just had to watch as this $125,000,000 orbiter vanished into the atmosphere. The thruster predictions didn't match what actually happened. The navigation team wasn't properly briefed on how the orbiter was oriented in space compared to earlier missions. Lockheed, who was responsible for converting to metric, had not. In systems engineering, the role that was meant to catch errors like this, the kinda human classic stuff of just like we just forgot a conversion step just wasn't robust and well built enough. To make matters, even worse, the orbiter was handed off to a new operations team mid mission, which added even more confusion. And a small conversion error destroy destroyed a $125,000,000 machine. I love this story. It's a story of tech going wrong. It's like a story of, like a little butterfly flapping its wings and there's a tsunami across the ocean, like a tiny conversion results in, like, a giant catastrophe. This isn't the only time, like, a trash unit conversion caused absolute chaos. 1983, the Gimli glider. So Air Canada's Boeing seven sixty seven ran out of fuel mid air due to a conversion mistake. Canada had switched from Imperial to Metric. In shortly prior to this. The fueling crew needed to convert liters to kilograms, and instead, they mistakenly calculated in pounds. The plane took off with about half of the, like, required fuel. 12,500 meters in the air, both of the engines of the plane died. Thankfully, the captain was an experienced glider pilot, and the co pilot knew the area that they were flying in. Together, they brought the aircraft down safely on an abandoned airstrip in Gimli, Manitoba, earning the nickname the Gimli Glider. Since I've started telling this story, my cat has woken up. He's agitated. The Institute for Safe Medication Practices reported a case where a patient received zero point five grams of phenobarbital instead of zero point five grains. A grain is zero point zero six five grams, so the patient was given nearly eight times the intended dose. Don't do that. I think the person lived. In 1994, the FAA found an international, American Airways cargo plane had landed 15 tons heavier than allowed, again, a botched kilograms to pounds conversion. This happens all the time. There's, like, a bigger lesson here, which is that, like, in engineering and in these kinds of very complex projects, there is a a class of software called finite element method software, FEM. Units inside of these pieces of software aren't preset. If you use meters, the rest of the system doesn't automatically reset or align to kilograms and seconds. So every time you set up one of these simulations, every time you program this piece of software, you have to, like, consciously check not just that you've done the conversions, but that all of your units match. And if you're collaborating with people from different parts of the world, you need to be aligned from the start. Pick your unit system up front. It's a small simple step that can cause you to not blow up a $125,000,000 machine. Goblin, that is the name of the cat, is staring at me right now. He hates it when he blows up, spaceships. Okay. The other story I wanted to talk about, it concerns airports and, it was sort of like a recent news story that has happened. Before I get to this, I wanna put a little pin in something we talked about in the last episode. So last episode, we talked about the story of the Velvet Sundown. That story was itself a couple of months old. I just hadn't read much about it. We covered it. For anyone that didn't catch that episode, it was the saga of a fake AI band and the hoax within a hoax of people claiming to be that band, people claiming that the other people weren't actually that band, and it all kind of, the the AI slop becoming a misinformation swap pipeline. Since we posted that episode, September 25, Spotify has announced that it is going to be taking some steps to address a copy written voice clone and AI slop problem. So tools like Sunio and Odeo, I still don't know if I'm saying Sunio right, Sunno? AI music generation tools that make it, very trivially easy to, like, just kick out vaguely passable music have resulted in streamers like Apple Music, Spotify getting just bombarded with AI generated music. Audiences don't know if what they're listening to is authored by a human. Artists are wondering whether or not their intellectual property is being infringed upon. Thursday of last week, Spotify announced that they were gonna be rolling out a series of new policies trying to, put a little bit of a cork in though that set of problems that these platforms are having with artificial intelligence, impersonations, slop. And as we spoke about on the show, something I think is very, very important, which is disclosure, making it clear to people whether or not they are listening to something that was authored by humans or computers. Quote, the so the goal that they're trying to realize is to, quote, protect authentic artists from spam and impersonation and deception. Trying to make sure that listeners don't feel duped, was the word that, Spotify used. Their global head of music product, Charlie Hellman, so they they host this big press briefing, and he tells reporters, you know, these are the sort of, like, three things that they're trying to prevent. At the same time, he said that Spotify wants to let artists use AI if they want to. There's this, music standard setting organization called Dedex that is developing a new metadata standard for disclosing the use of AI in any part of song creation. This would even include, and I find this fascinating, the use of AI in creating sounds that end up inside of an otherwise human authored track. Do you have AI generated vocals inside of a track you made? Do you have AI generated instrument tracks inside of a track you made? Dedeks, is looking to index and make transparent that process. We've talked at length about the challenges of using metadata to identify AI. It's you sort of just enter into an arms race. What's interesting here is, AI music generation done locally using open source software is far less common than text and images are. And so if they can get those small handful of large generators like Sunio and Oodio to embrace this d deck standard, you might be able to start making this work here. 15 record labels and music distributors have committed to adopting this policy of metadata and AI disclosures. There isn't, like, a specific timeline for when this is going to happen, but there are being moves made to sue to kind of lock down this issue of impersonation, to clean these systems up of slop, and to make it so that if people are using these tools, if people are doing voice clones, there is transparency, there is authorization with the original copyright holder. This is not a like, hey, everybody. We held a press conference and everything is solved type situation. But it is good, I would say, that, there is enough pressure on these companies to not let these systems become inundated with slop and to let, you know, the the intellectual property rights of the people who created this are to just sort of vanish into the ether under the weight of all that slop. So that's a broadly positive thing. Another story that I wanna talk about in this very normal episode, set in Terminal 2 Dublin Airport, Saturday morning. A bunch of printers go dead. A bunch of an agents find themselves handwriting boarding passes. You've got, lineups snaking out past duty free as the staff has to resort to manual workarounds just to, like, tag bags. That same scene is playing out from Heathrow to Berlin after a check-in system meltdown ripples across Europe. UK's National Crime Agency has arrested a man in his forties in West Sussex on suspicion of Computer Misuse Act offenses tied to this attack. Currently out on conditional bail while the probe continues, Quote, although his this arrest is a positive step, the investigation remains ongoing. So what happened here? Attackers hit Collins Aerospace's VMUSE, a shared check-in gate system used by multiple airlines forcing manual check-in and bag drop at a bunch of European airports, Heathrow, Brussels, Dublin, Berlin. These four, you know, reported the heaviest disruptions starting on Friday, September 19 through last weekend. The EU cyber agency, ENSSA, confirms this was a ransomware attack. So in Heathrow, you had cancellations and delays. In Berlin's Brandenburg, crazy airport, you had disruptions dragging on into midweek. They're they were still using manual procedures at the time of last sort of, like, major reporting on the story I could find. Dublin's t two, there is currently no timeline for a fix. No group has claimed responsibility for this on, like, any of the major leak sites, at least according to, like, law enforcement reporting. Researchers are split on, like, the strain of ransomware that was used for this. The two that I saw were Loki and Hardbit. These are both ransomware as a service tools that are more typical of, like, smaller operations, which makes the scale and outcome of this novel. The question of, like, why airlines multiple airlines were vulnerable to this single attack is that vMuse lets multiple airlines share kiosks and desks. When that vendor system fails, in the case of, say, a ransomware attack, the effects, like, kind of as a result of that immediately cascade across all of these different tenants. Even though that system is supposed to sit outside of, like, one company's enterprise network, the problem was able to spread further based on this design choice. Several of these airports are back up and running. Some of them, as mentioned, are still dealing with the fallout of this. If you're flying in Europe, maybe show up at the airport just a little bit earlier. Starting something new isn't just hard. It can be downright terrifying. You put a lot of work into a thing. You're not entirely sure it's gonna work out. You're taking a huge leap of faith. I've started a few things. Now I know I was right for believing in, you know, the idea, the product, despite all of those fears and hesitations. But boy, does it sure help when you have a partner like Shopify on your side. Shopify is the commerce platform behind millions of businesses around the world and 10% of all e commerce in The US. From household names like, well, hacked podcasts merch to brands just getting started, you can get started with your own design studio with hundreds of ready to use templates. Shopify helps you build a beautiful online store that matches your brand style. Did I mention that that iconic purple shop pay button that's used by millions of businesses around the world? I don't know why I wouldn't. I should. It's why Shopify has the best converting checkout on the planet. It also helps boost conversions, meaning less carts sort of getting abandoned in the parking lot, and more sales for you. It's time to turn those what ifs into

Speaker 2: sign

Speaker 1: up for your $1 per month trial at shopify.com/hacked. Go to shopify.com/hacked. One more time, that's shopify.com/hacked.

Speaker 3: This Father's Day, do more with dad and spend less with low prices guaranteed at the Home Depot. Get him fired up with a new grill and accessories, like the next grill five burner for just $299 so you can spend more time together while he becomes the grill master he was always meant to be. Or build memories with savings on top brand power tools so you can tackle projects side by side. Give more and do more together this Father's Day with help from The Home Depot. Exclusions apply at homekeeper.com/ price match for details.

Speaker 2: Whatever your thing, it could be anything. Canva helps you make that thing a thing. Canva is a simple online tool thing. It's a way to design with our magic AI tool things. You can social media your thing, generate images or videos of your thing, make decks or presentations to show your thing. Whatever needs to be done for your thing, Canva can make it an even better and bigger thing. Canva, the thing that makes anything a thing.

Speaker 1: Oh, Goblin. Duck Goblin, my dear cat. Where do we go next? Another story I wanted to talk about, very briefly, and we can wrap up because, you know, how long do you wanna listen to a fella babble? I think a long time ago we talked about this story. So back in 2014, a little known hip hop group, you might have heard of them, they're called the Wu Tang Clan. They recorded a record called Once Upon a Time in Shaolin, and they intentionally, pressed only one physical copy of the record. And the concept was, you know, much like a Picasso. They evoked this in the press. This is a piece of high art. The scarcity is part of its value. Enter, a character you, I'm sure, have heard of. A gentleman known as the pharmabro, Martin Shkreli. Shkreli is a former pharmaceutical executive and hedge fund manager. What's he known for? Starting in 2015, he was at the heart of a drug price scandal. He was the CEO of a company called Turing Pharmaceuticals. He raised the price of Daraprim. You have surely heard the story. It's a 62 year old drug used to to treat parasitic infections in vulnerable patients, including people with HIV AIDS. He raised the price of that drug from $13.50 to 750 US dollars per pill overnight. Sparked a bunch of outrage and made him this kind of symbol of corporate greed. He was then convicted of multiple counts of, securities fraud in 2017. Basically, charges laid out that he misled investors in his hedge fund, manipulating the stock in his company, Retrophin. He was sentenced to seven years in federal prison and ordered to forfeit $7,000,000 in assets. He he's been dubbed frequently the most hated man in America. So horn. So Martin Shkreli purchases this one of a kind album for $2,000,000 at auction in 2015. The sale contract reportedly restricted commercial release for 88 years, though he was allowed to listen to it privately. 2738, Shkreli is convicted of securities fraud. He goes to prison for seven years. As part of his forfeiture, the US government seizes his assets, including Once Upon a Time in Shaolin. In 2021, a crypto art collective called PleaserDAO, wins the government auction for the album. They pay about $4,000,000 for it. They want to preserve the album's exclusivity while kind of they say they're going to experiment with public access in creative ways. In 2022 and kind of into 2023, despite no longer owning that physical record, Shkreli starts to hint on livestreams that he still has digital copies, quote, Lol, I have the MP3s, you moron. August 2025, and this is why we are talking about this now, there is a court order. A judge ordered Shkreli to hand over any copies he has retained of the album. Pleaser Doubt was saying, like, Shkreli's possession and, like, just even the existence of these files undermines the album's carefully guarded value. 09/27/2025, why it came across my desk just in time for this very normal episode of Hacked. Judge Pamela Chen rules that PleaserDAO can proceed with a misappropriation of trade secrets claim against Shkreli. Yet another, legal hijink for old Martin. The court agrees that the album's worth is, quote, largely based on its secret and exclusive nature. Other claims are dismissed, but the Trade Secrets case is being allowed to move forward. For context, under US law, trade secrets aren't just like business y formulas, how the colonel makes his famous chicken, but really any information with economic value that comes from it being secret in in a reasonable measure taken to keep it secret. Based on that logic, this album qualifies because, really, its entire value comes from its exclusivity and its secrecy. He's facing a live lawsuit over retaining and copying the record. Police are now seeking damages and enforcement to protect the album's uniqueness. And this case is gonna hinge on whether music, when defined by extreme exclusivity, can legally function as a trade secret. It's a fascinating story. It touches on a bunch of stuff we talk about in the show all of the time. I'm probably gonna follow it. So, bringing us to here and now. We've talked about Airport Hacks. We've talked about Pharma Bro, Wu Tang Clan records. We've talked about Mexican bank heists. And I think that brings us to the end. I appreciate you you making it here with me. We're gonna be back in our next episode with our dear dear pal Scott, who we hope has recovered. I appreciate you coming along for the ride. I really do from the bottom of my heart. Thank you, Goblin the cat says thank you, and we will catch you in the next one.