Noble AntwiCloud Security & Identity Engineer
Case files

Real incidents, link by link.

Public breach reports, read in plain words. Each case file replays the attack, names the control that could have broken every link, maps it to MITRE ATT&CK, and says where that control stands in my lab: built, being built, or next.

Case file · November 4, 2026 · 10 min, with a replay

Five Months of Preparation, Four Minutes to Empty the Wallets

A plain-words reading of Binance's report on the 29 October 2026 theft: a poisoned download, a fake job interview, an internal AI tool with too much reach and one long-lived token on a laptop. Each of the seven links, the control that could have broken it, and where the same control lives in my lab.

incident-analysissupply-chainsocial-engineeringai-agentsagent-identityOpen the case file →
  1. The reportOnly what the organisation itself has published. Its figures, its times.
  2. The chainEvery step from first foothold to the last transfer, in plain words, with a replay.
  3. The controlsFor each link, the control that could have broken it, and the ATT&CK technique.
  4. The labWhere that control stands in my own lab, and the build that closes the gap.