Lateral Movement: How One Laptop Became a $6.3 Billion Theft

In late October, attackers took about $6.3 billion from Binance. The FBI attributed the theft to North Korea’s TraderTraitor group. Binance says the attackers compromised several systems, including an engineer’s laptop, and from there reached a privileged system that let them make the withdrawals. TRM Labs, a blockchain analytics firm, says the groundwork started at least 36 hours before the theft. Once the withdrawals began, most of the money was gone in about 20 minutes.

The same week, CrowdStrike reported that a China state-backed group it calls Vapor Panda had compromised about 140 targets in 11 days using an agentic AI penetration-testing framework. CrowdStrike’s Adam Meyers said hands-on-keyboard intrusions used to run up to 40 commands an hour. This one could exceed 1,500.

Put those together and you get the problem this post is about. Getting in is often the easy part. What decides the size of the loss is where the attacker can go next, and how fast.

What lateral movement is

Lateral movement is everything an attacker does between the first foothold and the objective. They land on one device, usually a laptop, a VPN appliance, or an exposed server. They collect credentials and map the network. Then they hop, system to system, until they reach whatever pays: payment systems, source code, customer data, domain admin, or the backups.

Most of that movement uses the same tools your administrators use every day: RDP, SSH, PowerShell remoting, PsExec, cloud consoles, and remote management agents. That’s why it’s hard to spot. The traffic looks like work.

MITRE ATT&CK tracks this as its own tactic (TA0008). In most of the incident reports we read, it’s also where the time goes. The first compromise takes minutes. Finding the path to something valuable takes hours or days.

Why flat access survives in so many environments

Nobody designs a network so that a marketing laptop can reach the payroll database. It happens a few permissions at a time.

• Engineers get broad access because they need it, and nobody removes it when the project ends.
• Admin work happens from the same laptop that reads email, opens attachments, and installs browser extensions.
• Service accounts and vendor tools get wide reach because narrowing them broke something once.
• The network was segmented for performance or for an old audit, so the segments follow building floors and VLAN history instead of risk.

The result is an environment where the blast radius of any single device is “most of the company.” Nobody can describe it in one sentence, so nobody owns it.

Speed changed the math

For years the defender’s bet was detection. The attacker had to work slowly and carefully, the SOC would catch something in the noise, and someone would contain it before the attacker reached the target.

That bet still matters, but it’s weaker than it was. Binance’s attackers prepared for 36 hours and executed in 20 minutes. Vapor Panda’s agents tried several attack paths at once, with requests as often as every 10 seconds. CrowdStrike counted about 45 agentic adversary attacks in September and 126 in October.

When the attacker’s tempo goes up 30 times, a detect-then-decide process built on morning queue reviews and change-control meetings falls behind. The controls that hold up are the ones that work without a human in the loop at the moment of attack: paths that don’t exist, credentials that aren’t standing, and containment that’s already authorized.

Six controls that limit lateral movement

1. Inventory crown jewels by what they can do. Start with actions instead of asset lists. Which systems can move money, sign code, push to production, change identity settings, or delete backups? That list is usually short, often under twenty systems for a mid-sized company. It’s the list that matters.

2. Map who and what can reach them today. For each crown-jewel system, list the devices, users, and service accounts that have a network path and a credential to it. Use real data (flow logs, firewall rules, identity group membership) rather than the architecture diagram. Expect surprises. In assessments, we regularly find general user subnets with direct access to management interfaces.

3. Separate admin work from daily work. Privileged work on crown-jewel systems should happen from a dedicated, locked-down device or session: a privileged access workstation, a hardened jump host, or an isolated browser profile with no email. If the engineer’s everyday laptop is phished, the attacker gets the laptop and nothing behind it.

4. Default-deny east-west traffic. Most networks filter traffic coming in from the internet and allow nearly everything inside. Reverse that for sensitive systems. Microsegmentation enforces “who can talk to whom” at the device level based on identity and labels instead of IP ranges, so a policy like “only the payments admin group, from managed admin devices, can reach the withdrawal system” holds even as people and machines move. This is the control that turns “the attacker is on a laptop” into “the attacker is stuck on a laptop.”

5. Remove standing privilege on high-impact actions. Access to crown-jewel systems should be granted for a task and expire. For actions that move money or change production, require a second person or a second channel to approve. Binance’s attackers needed a privileged system that would let them make large withdrawals. Every approval step between the foothold and that action is time the attacker has to spend and you get to use.

6. Pre-authorize containment. Decide now who can isolate a host, disable an account, or cut a segment at 2 a.m. without a meeting, and test it. If the first containment decision needs three executives on a bridge line, the 20-minute window is already gone.

Where to start in the next 30 days

You don’t need a full network redesign to cut the blast radius in half. A practical first month:

• Week 1: Write the crown-jewel list (control 1). Keep it to actions, and get the business owner of each system to agree.
• Week 2: Pull the reachability map for the top five (control 2). One page per system: what can reach it, from where, with which credential.
• Week 3: Pick the two worst paths and close them. Usually that means removing user-subnet access to management interfaces and moving admin work off daily laptops.
• Week 4: Write and test the containment authority (control 6). Run a 30-minute tabletop: “an engineer’s laptop is owned at 2 a.m. Who does what?”

At the end of the month, you should be able to answer the question in one sentence: if this laptop were compromised tonight, here is everything it could reach.

How SideChannel helps

Enclave is SideChannel’s microsegmentation and zero trust network access (ZTNA) platform. It puts identity- and label-based policy on each device, so you can wall off crown-jewel systems without re-architecting the network, and it gives you the asset and traffic visibility to build the reachability map in the first place. Our vCISO team runs the program side: the crown-jewel inventory, the access model, the containment playbook, and the board reporting. The strategy and the infrastructure, from the same team.