--- title: How Crypto Companies Can Break the Breach Cycle | daily.dev description: North Korean hackers stole $1.9 billion from a crypto exchange in February 2025 by phishing an engineer and locating static API keys, granting direct access to... canonical: https://daily.dev/posts/how-crypto-companies-can-break-the-breach-cycle-vruzscj9s twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How Crypto Companies Can Break the Breach Cycle | daily.dev og:description: North Korean hackers stole $1.9 billion from a crypto exchange in February 2025 by phishing an engineer and locating static API keys, granting direct access to... og:url: https://daily.dev/posts/how-crypto-companies-can-break-the-breach-cycle-vruzscj9s og:image: https://api.daily.dev/og/posts/vruZScJ9s.png og:image:alt: How Crypto Companies Can Break the Breach Cycle og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How Crypto Companies Can Break the Breach Cycle **[Teleport](https://daily.dev/sources/teleport)** · 5 min read · 0 upvotes · 0 comments ## Summary North Korean hackers stole $1.9 billion from a crypto exchange in February 2025 by phishing an engineer and locating static API keys, granting direct access to cloud resources. The piece argues traditional, employee-centric security models fail modern, elastic crypto infrastructure and that cumbersome access-request processes push engineers toward shadow access and hardcoded credentials. It pitches Teleport's cryptographic identity approach — short-lived, task-based privileges instead of standing credentials — as the fix, citing adoption by three of the top five crypto exchanges by trading volume. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did hackers steal $1.9 billion from a crypto exchange in February 2025? An engineer was phished, which allowed attackers to locate static API keys and gain direct access to critical cloud resources. No sophisticated exploit was required beyond compromising one engineer's access and finding hardcoded credentials, illustrating how static API keys create an outsized blast radius when leaked. _Teams hardening cloud access against credential theft can follow ongoing coverage of these incidents on daily.dev._ ### Why do engineers hardcode API tokens or leave SSH keys exposed despite security policies? Cumbersome access-request workflows that require waiting for IT approval push engineers to bypass controls to keep moving fast. Rather than repeatedly requesting elevated permissions through slow manual review processes, developers hardcode tokens into scripts or leave SSH key backdoors open, creating shadow access that undermines auditability and security posture. _Developers balancing velocity against security trade-offs can track this tension via daily.dev._ ## Similar posts on daily.dev - [One Foothold, 25 Million Victims: The Risk Inside Modern Breaches](https://daily.dev/posts/one-foothold-25-million-victims-the-risk-inside-modern-breaches-vblscqz3s) · Security Boulevard · 0 upvotes · 0 comments - [Out of the Crypt: The Evolving Cyber Extortion Economy](https://daily.dev/posts/out-of-the-crypt-the-evolving-cyber-extortion-economy-iefsjqq3n) · Unit 42 · 0 upvotes · 0 comments - [Ransomware groups switch to stealthy attacks and long-term access](https://daily.dev/posts/ransomware-groups-switch-to-stealthy-attacks-and-long-term-access-odq0idhho) · CSO Online · 0 upvotes · 0 comments - [North Koreans behind nearly half of US tech industry hacks, says CrowdStrike](https://daily.dev/posts/north-koreans-behind-nearly-half-of-us-tech-industry-hacks-says-crowdstrike-lst20len2) · TechCrunch · 0 upvotes · 0 comments --- Tags: [#cloud](https://daily.dev/tags/cloud), [#crypto](https://daily.dev/tags/crypto) [View this post on daily.dev](https://daily.dev/posts/how-crypto-companies-can-break-the-breach-cycle-vruzscj9s) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How Crypto Companies Can Break the Breach Cycle","url":"https://daily.dev/posts/how-crypto-companies-can-break-the-breach-cycle-vruzscj9s","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-crypto-companies-can-break-the-breach-cycle-vruzscj9s"},"datePublished":"2026-08-23T12:21:59.428Z","dateModified":"2026-08-23T12:43:33.937Z","description":"North Korean hackers stole $1.9 billion from a crypto exchange in February 2025 by phishing an engineer and locating static API keys, granting direct access to...","image":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","thumbnailUrl":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-crypto-companies-can-break-the-breach-cycle-vruzscj9s","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cloud,crypto","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"How Crypto Companies Can Break the Breach Cycle"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-crypto-companies-can-break-the-breach-cycle-vruzscj9s#faq","mainEntity":[{"@type":"Question","name":"How did hackers steal $1.9 billion from a crypto exchange in February 2025?","acceptedAnswer":{"@type":"Answer","text":"An engineer was phished, which allowed attackers to locate static API keys and gain direct access to critical cloud resources. No sophisticated exploit was required beyond compromising one engineer's access and finding hardcoded credentials, illustrating how static API keys create an outsized blast radius when leaked. Teams hardening cloud access against credential theft can follow ongoing coverage of these incidents on daily.dev."}},{"@type":"Question","name":"Why do engineers hardcode API tokens or leave SSH keys exposed despite security policies?","acceptedAnswer":{"@type":"Answer","text":"Cumbersome access-request workflows that require waiting for IT approval push engineers to bypass controls to keep moving fast. Rather than repeatedly requesting elevated permissions through slow manual review processes, developers hardcode tokens into scripts or leave SSH key backdoors open, creating shadow access that undermines auditability and security posture. Developers balancing velocity against security trade-offs can track this tension via daily.dev."}}]} ```