Denuvo is based on VMProtect, at least in part, which implements DRM through virtualization and encryption of the original code. Since it takes days to "crack Denuvo", I'm guessing they are cracking the encryption key or doing some sort of statistical reassembly of the raw code from a sample base. In either case it doesn't sound like there are any insiders involved, no.

https://vmpsoft.com/

The back story is that at some point VMPSoft was suing Denovo for buying a single license of VMProtect and then using it to roll out their own DRM system. It was a complete LOL really. They ended up settling out of court.

Is it based on vmprotect? I thought it can just be combined with it. There are games that use both.

From what I remember it used to be just a wrapper around VMProtect. This was a couple of years ago though, so you are most likely right.

If anything, insiders usually leak pre-release builds so crackers can start early.

Denuvo state themselves that it only protects for certain period not infinitely so probably it is just hackers not releasing cracks immediately due to multiple possible reasons:

1) legal action if published got his 2-3 months when sales are at peak they are less likely to go after the crackers

2) games are often released very buggy thanks to online patching available, so they just wait for games to stabilize as not to update cracks weekly

3) less demand for cracks due to steam and sales, I feel like people wait for sales or prices to drop off in general