the laptop that can reach production

Three of the best-documented breaches of recent years started in the same place. In 2022, LastPass said, an attacker targeted a senior DevOps engineer, planted malware and used it to reach the company’s cloud backups. In February 2025 a developer’s laptop at Safe, the wallet software Bybit used, was compromised, and the theft that followed came to about $1.5 billion according to the FBI. On 30 October 2026 Binance said its initial investigation pointed to a compromised DevOps engineer’s laptop, in a theft TechCrunch put at $6.3 billion.

In each case the first thing the company lost was an engineer’s computer that could reach the servers.

This guide is about that laptop at your company. It pairs with the identity you can’t offboard, which covers the accounts no human logs into. This one covers the human accounts that can do what those service accounts do, from a machine that also opens email attachments.

how a laptop becomes the way in

1. 1a normal weekThe engineer fixes production from their laptop, because that is fastest.
2. 2sessions stay openCloud consoles, the deploy tool and the admin panel all stay signed in.
3. 3one bad fileA test project, a job assignment, a tool update. It runs as the engineer.
4. 4it asks as themEvery system sees the usual person, on the usual machine, at a normal hour.

why the laptop is the soft spot

It holds live sessions. Second factors protect the moment of sign-in. After that, the proof of who you are is a session token sitting on the laptop. Safe’s preliminary report on the Bybit theft, as reported by CryptoSlate, says its cloud setup asked for MFA again every 12 hours. The attackers tried to register their own MFA device, failed, and used the developer’s open sessions instead. The token guide explains why a token keeps working after the conditions that issued it have changed.

It runs whatever its owner runs. Engineers download code from strangers as part of the job: a library, a sample project, a container someone shared. The Bybit chain began, according to Safe’s report, with a Docker project the developer added that contacted a malicious domain. Nothing about it needed a vulnerability. It ran because running things is what the machine is for.

It is the target, by name. In April 2022 the FBI, CISA and the US Treasury described how TraderTraitor, the North Korean group later named for Bybit, picks its victims. The advisory says they go after people in system administration, software development and DevOps, with messages that imitate recruitment and offer high-paying jobs, and with trading apps that carry malware. That advisory is about crypto companies, and the method works on anyone whose laptop opens doors.

It reaches further than anyone wrote down. At most companies production access grew one fix at a time. Nobody decided that a laptop should reach the payment server. Someone needed to restart a job once, the access stayed, and access debt did the rest.

The perimeter is wherever an engineer’s session is open.

what this looks like at your size

Picture a 150-person company with three engineers and no security team. One of them set up the cloud account, the deploy pipeline and the scripts that send invoices and payment batches. Their laptop has a terminal open to production most days, the cloud console stays signed in for weeks, and the password manager holds the root login “just in case”.

None of that is careless. It is how small teams keep things running. It also means that this one laptop is, in practice, the company’s most privileged machine, and it is the one that opens job-offer PDFs, browser extensions and test projects from GitHub.

two ways to see the same laptop

what people think

an endpoint like the others

• Managed like every company laptop
• Protected by MFA on every login
• The servers are what needs guarding

what is really there

a production system with a mail client

• Signed in to the cloud, the pipeline and the admin panel for days at a time
• Runs code from strangers as part of the job
• Whatever it asks for, production does

what narrows it

You will not make that laptop safe. You can make it matter less.

Separate the everyday from the powerful. Daily work happens in an account that cannot change production. Production changes happen through a second account, or a separate browser profile at the very least, signed in only for the task and signed out afterwards. It is clumsy for the first week and normal by the third.

Make sessions to powerful systems short. Most cloud providers and admin consoles let you set how long a session lasts, and the defaults are often generous. For anything that can delete data or move money, a few hours is plenty. Open sessions are how the Bybit attackers got past MFA.

Put a second person in front of the irreversible actions. Payments over a threshold, deletions, changes to the deploy pipeline itself. Bybit had a second person and the screen still lied to both of them, which is covered in the Bybit case. The second check has to come from somewhere the laptop cannot touch: a bank notification, a phone, another person’s own machine.

Cap what one request can do. Binance’s investigation is still open, but TRM Labs’ timeline shows its Ethereum hot wallet sending its entire balance in one transaction. Daily limits on payments, rate limits on exports and quotas on deletions turn a total loss into a partial one. The blast radius guide is the way to find where those limits matter most.

Treat unsolicited job tasks and shared projects as untrusted. Run them in a throwaway virtual machine or a cloud sandbox, never on the laptop that holds production sessions. Say this out loud to your engineers, once, with the TraderTraitor advisory as the reason, because it goes after the first step of the Bybit chain as Safe described it. Fake job offers, and fake candidates applying to you, are covered in the job that comes with a laptop.

the question to take to your team

Which single laptop in your company, if someone else were typing on it for twenty minutes tonight, could move money or delete production? If the answer comes quickly, start there. If nobody knows, that is the first thing to find out.