Targeting the People With Access

As protectors, we pay attention when someone takes an unusual interest in our principal. We look at who they are, what they want and whether their explanation holds up. But an approach to somebody on the staff can look much less concerning, particularly when it comes from a recruiter offering better money.

Investigators believe the $6.3 billion theft from Binance began with a compromised engineer’s laptop. How the attackers reached that employee is still unclear, but North Korea has a documented history of using convincing job offers and interviews to get close to people with valuable access.

So, would someone around your principal recognize an approach like that as something worth mentioning? This week, On the Circuit, we look at the people an attacker may choose to reach first, and why an apparently good career opportunity can deserve a second look.

Late on Thursday, October 29, someone began moving cryptocurrency out of Binance, the world's largest crypto exchange. Within about 20 minutes most of roughly $6.3 billion had left its wallets across 10 blockchains, more than four times the previous record, the $1.5 billion taken from the exchange Bybit in February 2025. Binance suspended deposits and withdrawals that night and began reopening them in phases on Sunday, November 1. On Saturday the FBI said North Korea was responsible, naming TraderTraitor, the same unit it blamed for Bybit, CBS News reported.

The attack is believed to have started with one employee. Binance's first account pointed to a compromised engineer's laptop, and on November 2 Bloomberg reported that investigators believe the hackers used it to reach the systems that process withdrawals. Binance has since cited "additional points of breach" without saying what they are, and its full technical report has not been published. "This was a complex attack," the company said.

How that engineer was reached is not yet public, but North Korea's methods are well documented. Analysts at the blockchain investigations firm TRM Labs told Bloomberg that earlier North Korean thefts often came from simply stealing the digital keys to a wallet, while recent ones took weeks of targeted manipulation, possibly including in-person meetings with the people being targeted. Federico Charosky of Quorum Cyber said a common technique is to invite exchange engineers to fake job interviews, where they are persuaded to install malicious code. The FBI described the same approach in a 2024 public warning: job offers built from the target's own professional profile, long friendly conversations in fluent English, and a "pre-employment test" that asks the candidate to run a piece of code.

About $3 billion of the stolen funds has been frozen, more than $2.3 billion of it by the companies behind two major digital dollar tokens, Tether and Circle. Binance says it is covering the loss from its own funds and had replaced 95% of the stolen assets by Sunday, TechCrunch reported. The FBI says the group is converting the rest into Ethereum to launder it and has asked companies to block transactions linked to its addresses. "In one evening, North Korea took around what they stole over the previous six years combined," said TRM's Ari Redbord. Western governments say North Korea uses the proceeds of its hacking to pay for its weapons programs.

The money reportedly left Binance in about 20 minutes. We do not yet know how long the attackers spent preparing, but North Korea’s established methods show a willingness to spend weeks getting close to the people who can provide a way in. The speed of the theft should not distract from the patience that may have made it possible.

There are limits to what we can conclude here. Investigators believe an engineer’s laptop was compromised, while Binance says there were additional points of breach. Nobody has publicly established how that engineer was reached. A fake recruiter is a documented method, not yet a confirmed part of this case.

Even with that uncertainty, the protection relevance is clear. The employee did not need to control billions personally to become valuable to the attackers. Their access was enough. That is why the people surrounding a principal deserve attention in their own right, including the professional approaches they may never think to bring to the detail.

Government travel advice tells you a country is risky. It doesn't tell you what will actually hurt your principal once you're on the ground. Our new Global Risk Map does.

We've scored the world's toughest operating environments on the six things that get protection teams into trouble: violence, kidnap, unrest, local rules, how fast the ground is shifting, and how hard it is to get your people out. One look tells you whether a trip is routine or a hard no, and what's changed since last quarter.

It's free. Check your next destination before you book the flight.

🇪🇹 Ethiopia. The US Embassy told Americans on October 30 not to travel to Tigray, Amhara, including Lalibela, or Afar, and to leave if it is safe to do so. Flights to Axum and Shire remain suspended.

🇹🇿 Tanzania. The US Embassy warned of roadblocks, checkpoints and internet blackouts during opposition mourning that runs to November 4. Opposition leader Tundu Lissu's treason verdict is due November 6.

🇭🇹 Haiti. The US Embassy reported ongoing security operations near Tabarre and Croix-des-Bouquets on November 2, two days after gunfire near the Tabarre bridge, and told Americans to avoid the area.

🇫🇷 France. Authorities counted about 320,000 protesters and 565 arrests on October 31, and officers were hit by Molotov cocktails in Paris. Unions have called another demonstration for November 5.

STATE THREAT. UK prosecutors charged two 24-year-old London men on October 27 over the RAF Fairford plot. Mohmed Abdulkarim is accused of helping a foreign intelligence service and receiving about £70,000 from a handler known as "Ali," whom police believe works for Iran. Nouman Essghir allegedly filmed the base perimeter for Ali on August 22, five weeks before the vans arrived.

STATE HACKING. Ahmad Umar Agha, a Syrian who hacked about 47 Western media outlets, companies, charities and government bodies for Bashar al-Assad's government, was sentenced to 42 months on October 29. His group's fake 2013 report that President Obama had been injured briefly wiped $136 billion off US stocks. One charity spent $480,000 recovering, including retraining more than 800 staff.

A full calendar is reassuring, but it can hide how dependent your income is on being able to turn up. A principal changes their arrangements, a contract ends or you get injured, and the next month looks very different. Building another source of income is easier while the day rate is still paying the bills, particularly when the alternative may take months to produce anything.

This week’s Premium article prices six ways protectors turn their experience into paid work beyond the detail. We look at what each route requires, what it can pay and how long you may wait for the first invoice to clear, with figures for the US and UK. The accompanying Second Income Revenue Model lets you compare those options with your current earnings. There’s also a 12-month plan to help you move from meaning to start something to having a service you can actually sell.

Upgrade for subscriber-only tactical analysis and every future briefing →

Q: What most often gets in the way of changing a principal’s routine?

🟩🟩🟩⬜️⬜️ Their preference for doing things a certain way (63%)
🟧🟧⬜️⬜️⬜️ The demands of their job (25%)
🟨⬜️⬜️⬜️⬜️ Limited people or budget (6%)
⬜️⬜️⬜️⬜️⬜️ Few practical alternatives (0%)
🟨⬜️⬜️⬜️⬜️ Something else, let us know (6%)

DPS: “Everyone wants things to get better but no one wants anything to change. A power/control (paradox) that cannot continue for elected officials. Some of their decision-making pertaining to their own security must be removed...”

DA: “Arrogance of thinking they can do whatever they want, whenever they want and won’t be told what to do by a “Security Guard”.”