An employee, contractor or ex-employee with legitimate access.
5 real attacks
October 31, 2026
Binance traced the $6.3 billion theft to a compromised DevOps engineer's laptop, which enabled unauthorized withdrawals; the exchange says no private keys leaked and user funds are covered. Roughly $3 billion is frozen on-chain, including 1.567 billion USDT by Tether and 800 million USDC by Circle. TRM Labs and other blockchain analysts attribute the operation to North Korea's TraderTraitor, making this the largest single crypto theft on record. Deposits resumed; withdrawals remain suspended pending a service overhaul (BleepingComputer, SecurityWeek); earlier coverage.
· Threat Intelligence
September 25, 2026
Tampere University fired a researcher now remanded in custody on suspicion of aggravated computer intrusion. The dismissal decision cites serious and repeated breaches of the university's IT usage rules, surfaced by IT administration's own monitoring last summer; the alleged offence period runs from August 2025 to early July 2026 and the National Bureau of Investigation is handling the case. Yle
· Nordics
July 29, 2026
India's state-owned Bank of Baroda confirmed a breach stemming from a compromised employee email account; a dark-web listing reportedly exceeds 700GB, including customer ID documents, loan and audit records — the bank says core banking systems were untouched (The Record) (earlier coverage).
· Data Breaches
July 26, 2026
A group of former DPRK military cyber operators reportedly hacked their own state banks — Chosun Central Bank and Foreign Trade Bank — skimming small amounts below detection thresholds and laundering via crypto and Chinese brokers before arrests on July 12, per Daily NK.
· Threat Activity
July 12, 2026
Apple sued OpenAI, alleging a "coordinated campaign" to poach 400+ ex-Apple staff — including former iPhone design chief Tang Tan — and steal trade secrets tied to unreleased hardware, as OpenAI builds out its own hardware division. The Decoder
· Policy