The insider’s exploit went unnoticed for months, despite over 36 individual transactions.