In the Binance version of reality where compromise happened via a developer laptop:
1) Was this laptop running an appropriate EDR? If so, how did it remain compromised and active for so long?
2) If it wasn't, why was it in such a privileged position that it could trigger this outcome?
The point of entry may have been a single developer's laptop, but the fact that a single developer's laptop *could* be the point of entry is a systemic failure, not an individual one
@mjg59 Separately from the technical angle, I think stories with a single villain are much easier to sell: "this guy messed up" rather than "the organisation should have done a thing but it didn't".