The Audit Passed. The Operation Didn't.

In February 2025, Bybit lost $1.46 billion in a single transaction, the largest theft in the industry’s history. The investigation that followed reached a conclusion worth stating plainly. In Bybit’s own words, “no vulnerability was detected in Bybit’s infrastructure.” The exchange’s code held, its keys were not cracked, its servers were not breached. The signing screen, served to Bybit’s approvers by a third-party provider, is what lied to them, and the approval it collected moved the money. The application was sound; everything it sat inside was not.

That second thing has a name, and most security programs do not test for it. Application security asks whether the code is correct: an audit reads the contracts, a penetration test probes the running app, a controls checklist confirms the pipeline exists. Operational security asks a different question, whether an attacker can reach what the code protects without defeating the code at all. The thing worth protecting sits outside the application: a treasury, a set of signing keys, a repository of source, a model’s weights. Around it stands the operation, in four parts an audit never reads: who may act as the company, the code it pulls in and ships, the services it delegates to, and the machines its people work on. For most of the last three years, the losses came through those four, not through the code.

The first part is identity: the set of principals allowed to act as the company. It is rarely just employees and a directory, and now includes contractors, machine credentials, and the outside tools an engineer signs into with a work account, each of which becomes a key to the building. In April 2026, Vercel disclosed that attackers had compromised a third-party AI tool one engineer had adopted, rode the engineer’s federated Google Workspace login into that account, and from there reached environment variables inside Vercel. No Vercel system was breached first. A login the company had extended to an outside tool was. The defensible version is an access graph the company can actually enumerate, down to which tools each person can authenticate to, and most organizations cannot.

The second part is the code the company did not write but runs anyway. Every dependency it installs and every pipeline it ships through is trusted without being read, and a compromise upstream arrives as a compromise at home. In March 2026, attackers reached axios, a package pulled from npm on the order of 100 million times a week, not by breaking its code but by taking the one account that could publish it, after the maintainer’s own laptop became the release path. The same month, Mercor was breached through a poisoned version of the open-source LiteLLM library it had installed like any other, and LiteLLM traced its own compromise to Trivy, the security scanner inside its build pipeline. The defense splits in two: vet and pin what gets installed, and secure the machinery that ships what gets published.

The third part is the outside services the company delegates its operations to: a signing provider, a custody platform, a tool with standing access to its systems. The two largest single losses in this whole set both entered here, and both were signing vendors. Bybit lost $1.46 billion in February 2025 after attackers modified the signing interface served by Safe, its third-party wallet provider. Its approvers signed what the screen showed while the payload moved the funds, and Bybit’s own forensics found no vulnerability in its infrastructure. In May 2024, DMM Bitcoin lost about $308 million to the same pattern. Attackers the FBI attributed to North Korea compromised a developer at Ginco, the firm that ran DMM’s signing, and swapped the destination address on a transaction in transit. No DMM employee was ever contacted. In both, the company’s systems were sound and a service it depended on was not.

The fourth part is the machines themselves, the laptops and workstations the operation runs on, trusted to run only what the company put there. In October 2024, Radiant Capital lost about $50 million after a developer opened a file sent over Telegram by someone posing as a former contractor. The file carried a backdoor. Weeks later, at signing time, the compromised machine showed the signers a routine transaction on their hardware wallets while the real payload transferred control of the protocol. There was no poisoned dependency and no breached vendor: a trusted device ran code the company never authorized, and everything it displayed afterward was a lie. The defense is endpoint hygiene, starting from the assumption that a developer’s machine is a production system.

None of these four is the asset itself. The treasury, the keys, the source, the model weights sit at the center, and the four parts are the routes to them. For an AI company the center is a set of weights, and RAND’s 2024 study of how weights get stolen maps 38 attack paths and rates each against attacker capability. The one that scores feasible at every tier, from a lone opportunist to a state program, is social engineering aimed at the people with access. The most authoritative map of the crown-jewel asset points back at the operation around it, not the code that holds it.

Two things run through all four. Every one of these attacks began with a person rather than an exploit: a staffed Slack workspace, a recruiter’s file, a fake update, an adopted tool. And in three of them the loss landed at the same instant, the moment of authorization, when what a human or a system approved was not what executed. Neither is a fifth part of the operation, they are the method that crosses the four and the seam where crossing them pays off.

These four parts share one property, and it is structural rather than accidental. An audit is a point in time; the operation runs continuously, and a laptop clean at review can be owned a month later. An audit covers one company; the operation spans every supplier, contractor and tool it depends on, none of which the auditor is engaged to test. An audit reads artifacts and diffs them against a known-good state; the operation is made of people and trust, and a convincing Slack workspace leaves nothing to diff. The attacker treats the whole operation as the system. The assurance treats only the code as the system. That gap is not a finding an audit missed. It is a surface the audit was never pointed at.

The defensive moves that follow cost nothing and map to the four parts. Identity means an access graph the company can actually enumerate, including the tools each person logs into. The code supply chain means vetting and pinning what gets installed, and securing the machinery that ships what gets published. External services means scoping what a vendor can do and treating its access as part of the company’s own attack surface. Devices means assuming a developer’s machine is a production system, with the endpoint hygiene that implies. None of it requires a purchase.

The audited perimeter and the real perimeter have drifted apart. Everything inside the code got harder to attack, so the attacks moved into the operation around it, and that is the part still going unwatched. Closing that gap is what Common Defense does: an OpSec Review examines the operation around an application, the way an AI-enabled adversary attacks it, and ends in a prioritized plan to harden each part.