Assumed Breach Pentest: Starting From a Compromised Laptop

By the Guardian team Updated November 2026 6 min read

Quick answer. An assumed breach pentest starts from a foothold, such as a developer laptop, and tests how far it reaches. Crypto firms holding keys should run one: the Radiant, Bybit and Binance hacks began on compromised developer machines.

Watch: Assumed Breach Pentest: Starting From a Compromised Laptop 1:41

Video transcript

The Radiant, Bybit and Binance hacks began on compromised developer machines. An assumed breach pentest starts there, and tests how far it reaches.

TRM Labs says North Korea accounts for 85 percent of crypto hack value in 2026 so far. TRM describes the lure: a fake recruiter's coding test carrying malware.

An external pentest tests the perimeter. A red team tests detection and response. An assumed breach pentest starts inside, and spends its budget on what comes next.

Recent incidents point to four likely footholds: an engineer's laptop, a cloud or vendor credential, a CI or deploy token, and a signer's device.

Can the foothold move funds or change what gets signed? Trace it from discovery and credential access, through escalation and lateral movement, to impact.

Ask for attack paths, not just findings, showing where controls held and when anyone noticed. Prove impact on a fork or testnet, never with real funds.

To scope one, name your crown jewels, pick one or two footholds, and build them to match reality. Put limits and stop conditions in the rules of engagement.

Guardian's offchain services are led by Carlos Polop, co-founder of HackTricks training. Its infrastructure pentest checks what one stolen key unlocks, and the OpSec audit maps every path to your funds.

Read the full article for the crypto-specific test questions, or talk to Guardian at guardian.security.

North Korea accounts for 85% of crypto hack value worldwide in 2026 so far, TRM Labs reported on October 30. Only 13 of the 100 incidents TRM attributes to it were code exploits.

TRM describes how it gets in: a fake recruiter or investor persuades a target to download a coding test. The test delivers malware that yields SSH keys, session cookies and cloud tokens.

An external pentest asks whether an outsider can get in. An assumed breach pentest skips that question and asks what happens next.

What Assumed Breach Means

Assume breach is one of Microsoft's three Zero Trust principles. Controls are designed "with the expectation that attackers might be operating inside the environment."

An assumed breach pentest tests that expectation. The client hands the testers a foothold, and they try to turn it into what an attacker wants.

NIST SP 800-115 describes the same idea for internal testing. Assessors "assume the identity of a trusted insider or an attacker who has penetrated the perimeter defenses."

The foothold saves time, not realism. TIBER-EU, the European red teaming framework, notes that real attackers may have months to prepare.

A short test that spends its budget breaking in may never reach the keys.

Assumed Breach vs Pentest vs Red Team

	External pentest	Assumed breach pentest	Red team
Starts	Outside the perimeter	With access the client provides	Outside, with leg-ups if blocked
Asks	What can an outsider exploit?	What can this foothold reach?	Would we detect and stop this?
Breadth	The internet-facing scope	Paths from the foothold to key assets	Narrow and goal-driven

A red team resembles what NIST calls covert testing: run without the IT staff's knowledge, with upper management's permission. It examines the damage an adversary can cause, not every vulnerability.

Red teams use the same shortcut when they get stuck. Under TIBER-EU, a blocked red team can be given a "leg-up," such as access to a system or the internal network.

An assumed breach pentest starts with the leg-up, and spends its whole budget on what happens after it.

Crypto Starting Points

Pick the foothold an attacker would most likely get. Recent incidents point to four.

A developer laptop

In September 2024 the FBI listed requests to run a "pre-employment test" or debugging exercise among the signs of North Korean social engineering. It advises against running such code on company devices.

Binance's November 3 initial report describes the same lure: a fake recruiter's "assignment" repository, downloaded to an engineer's work computer, ran malicious code during setup.

At Radiant Capital, a developer received a Telegram message spoofing a former contractor in September 2024. Radiant says the malware compromised three developers' devices.

Test from a laptop built like your engineers' laptops, with the same access, tools and saved sessions.

A cloud or vendor credential

Bybit lost about $1.5 billion on February 21, 2025, according to the FBI. Safe says the attack came through a compromised Safe{Wallet} developer machine.

Sygnia found malicious JavaScript on Safe's AWS S3 bucket, BleepingComputer reported. It concluded Safe's S3 or CloudFront credentials were probably leaked or compromised.

Test with a cloud credential an engineer holds, and see what it can change in production.

A CI or deploy token

In March 2025, the compromised tj-actions/changed-files GitHub Action printed CI/CD secrets into workflow logs (CVE-2025-30066).

At Binance, one engineer's computer held a container deployment token. Using his stolen credentials, the attacker deployed a container and reached an internal wallet signing service, Binance says.

Our Binance hack explainer walks through each step.

Test with a token from your pipeline. Can it ship code, change a frontend or deploy a contract?

A signer device

Radiant's attackers then collected valid multisig approvals. Radiant says its front end showed benign transaction data while malicious transactions were signed in the background.

Test from a signer's machine, and see what a signer can be made to approve. Our guide to signing interface security covers the defenses.

What to Test From the Foothold

The objective is the same in every scenario: can the foothold move funds or change what gets signed?

MITRE ATT&CK names the steps between a foothold and that goal. Map the test to them:

Discovery: what the foothold can see, from repositories and cloud consoles to chat and wikis.
Credential access: SSH keys, session cookies, cloud tokens, .env files and deploy keys.
Privilege escalation: developer to cloud admin, repository write to release.
Lateral movement: laptop to CI, CI to production, production to the signing service.
Impact: a signing request, a frontend change or a contract upgrade.

Then the crypto-specific questions:

Which roles can call your key management or signing API, and from where?
Can a hot wallet withdrawal go out without a second, independent approval?
Can a signer's screen show one transaction while the device signs another?
Who can write to the bucket or CDN that serves your signing interface?
Does anyone notice, and how fast?

The FBI recommends approvals "from several different unconnected networks" before company funds move. Test whether yours hold. Prove impact on a fork or testnet, never with real funds.

Deliverables and Metrics

Ask for attack paths, not just a list of findings. Each path should run step by step from the foothold to the asset.

The starting access, and exactly what it included.
Each path to keys, signing or production, with evidence.
Where a control stopped the testers, and where none did.
When each stage was detected, if it was.
Fixes ranked by the paths they close.

NIST counts defenders' ability to detect and respond among the things a pentest can measure. PTES suggests testers track detection and response times.

TIBER-EU closes a red team test with a replay, where attackers and defenders walk through each step together. It is worth borrowing.

How to Scope One

Name the crown jewels: hot wallet keys, signing services, admin roles, the deploy pipeline.
Pick one or two footholds from the starting points above.
Build each foothold to match reality: a real laptop image, role and tooling.
Set limits: no mainnet funds, no production keys, no customer data.
Decide who knows: the whole security team, or only leadership.
Write it into the rules of engagement, with stop conditions.

Our pentest rules of engagement template has the clauses. For the basics, see what penetration testing is.

How Guardian Helps

Guardian's offchain services are led by Carlos Polop, Head of Offchain Services, who co-founded and built HackTricks training.

Guardian's infrastructure pentest treats your cloud "as a set of accounts to escalate through until something signs."

It checks what a single stolen access key unlocks, and whether a compromised pipeline can ship or sign on your behalf.

The OpSec audit maps every path to your funds. It examines what a signer actually sees before approving, and what it takes to slip a malicious payload past them.

Offchain automation pentests test keepers, relayers and threshold signers with hostile inputs and part of the set compromised.

Managed Security keeps that threat model current, and Guardian's security operations team reviews every multisig transaction before it is signed.

Frequently Asked Questions

What is an assumed breach pentest?

A pentest that starts with access the client provides, such as a laptop, account or credential, instead of breaking in first. Testers measure how far that access reaches toward critical assets, and whether anyone notices.

What is the difference between assumed breach and red teaming?

A red team usually starts outside, runs covertly and tests detection and response against a goal. An assumed breach pentest starts inside and spends its time on the paths from the foothold to critical assets.

Does a crypto company need an assumed breach pentest?

If it holds keys or runs signing systems, yes. The FBI has warned of North Korean coding-test lures aimed at crypto staff, and the Radiant, Bybit and Binance hacks all began on compromised developer machines.

Which starting point should we test from?

The one an attacker is most likely to get: an engineer's laptop, a cloud credential, a CI token or a signer's device. Start with the one or two closest to your keys.

Sources

Find every path from a laptop to your keys

Guardian's offchain team maps how far one compromised device, credential or signer could reach, and what closes each path.

Talk to Guardian Explore Managed Security