The $6.3 Billion Heist That Started on One Laptop
Modern breaches rarely start by smashing through the perimeter. Increasingly, they start with access an organization has already granted. On October 29, attackers drained roughly $6.3 billion from Binance, the world’s largest crypto exchange. It is the biggest crypto theft on record, and most of the money was gone in about 20 minutes.
No private keys were stolen. Binance’s initial investigation points to a compromised DevOps engineer’s laptop. That computer gave attackers the access they needed to submit withdrawals that Binance’s own systems processed as legitimate. The company has since found additional points of breach over several months and promised a full technical post-mortem.
This is the new face of insider risk. The attacker wasn’t an employee. But to every downstream control, the activity came from a trusted engineer and a trusted service. The controls didn’t fail because they were broken. They failed because the requests looked like normal work.
Why a DevOps Laptop Is a Crown Jewel
An engineer’s laptop holds the keys to everything. The passwords, access codes, and open connections an engineer uses every day all live on that one machine. If attackers take control of it, they don’t have to break in. They just log in as someone the company already trusts.
The FBI has attributed the theft to TraderTraitor, the North Korean group behind the $1.5 billion Bybit hack in 2025. TraderTraitor has a long record of targeting crypto engineers with trojanized applications and fake job offers, including “take-home projects” that run malicious code on the engineers’ own machines. Binance confirmed that attackers masqueraded as recruiters and hiring managers, using fake interviews and malware disguised as interview assessments as part of the attack.
Why the Security Stack Missed it
Most security stacks watch the edges of an attack, not the middle. Transaction monitoring reviews withdrawals after they’re submitted. Blockchain analytics track funds after they leave. Signing infrastructure checks whether a request is authorized, not whether it should be made at all. EDR hunts for known malicious code, not a legitimate identity doing something it has never done before. These tools can’t answer the question that matters: Should this user, or this process, be doing this right now?
The Warning Signs Live on the Endpoint
InnerActiv sees how people and processes actually interact with applications and data on the endpoint: what's on the screen, which process touched which file, and where that file came from and went next. It builds behavioral baselines for all human and synthetic identities — and flags activity that breaks from them in real time.
In an attack like this one, that means:
- Seeing full desktop context, including all administrative actions and any agentic AI that could be used nefariously.
- Blocking all unapproved automation and AI activities.
- Viewing recruiter messages or job-offer files on privileged engineering machines, as well as unfamiliar applications or scripts.
- Identifying secrets or sensitive files that move to destinations they’ve never visited before.
Individually, none of these events signal an attack. Together, they tell a very different story. Whether it’s a recruited employee, a phished engineer, or a hijacked laptop, the warning signs show up on the endpoint long before they show up in a transaction log. That gives security teams time to investigate, coach, or enforce policies before access turns into loss.
The Binance hack is a reminder that the most dangerous access in your organization is the access you’ve already granted. If you’re wondering what your privileged endpoints, and the automated processes running on them, are doing right now, request a demo or a proof-of-value trial at Inneractiv.com.
About InnerActiv
InnerActiv sees what others can’t. Founded in 2009 and based in Columbus, Ohio, InnerActiv provides endpoint-native visibility and control over insider risk, fraud, data exposure, and AI usage. By combining process and file telemetry with display-level visibility, InnerActiv shows what every user and non-human identity actually does, helping organizations stop risky activity before it spreads.
Enable AI. Control the Risk.
Two TD Bank Insiders. Two Fraud Schemes. One Massive Blind Spot
Two former TD Bank employees. Two separate fraud schemes. More than $9 million in combined losses. Both prosecuted by the U.S. Department of Justice. Both carried out by insiders who had every right to be in the systems they abused.
