I just saw Binance's official Twitter account release their security investigation report, and it sent chills down my spine. Here's a summary based on my understanding: September: Software engineer B was contacted by a "project director" on a legitimate job search platform, who actively recruited him. I'm guessing it was most likely LinkedIn, which exposed B as a current Binance employee. The project director arranged two rounds of interviews: the first was a so-called HR video interview to gain B's trust; the second was conducted via instant messaging by a fictitious company CEO, during which B was instructed to download an "assignment" containing a malicious codebase to his work computer. This malicious codebase executed during installation, triggering a series of unauthorized activities. Moreover, it was a zero-day malware, which Binance's endpoint security software failed to detect at the time. The hacker also deliberately erased intrusion traces, increasing the difficulty of discovery and investigation. October 20th: Starting from B's computer, the hacker used Binance's internal AI tools to gain control of the computers of wallet operations engineer A and wallet software engineer C. After gaining control of A's computer, the hacker discovered a container deployment permission token. October 29th: The hacker logged into employee C's computer, used the credentials stolen from A to deploy a container, and ran a malicious script, thereby gaining access to the internal wallet signing service and initiating transfers outside the normal withdrawal process. The hacker then used EIP-7702 authorization to transfer assets on the ETH blockchain in bulk. Earlier, in June, A had actually downloaded a tampered Homebrew installation package after searching for popular AI programming tools on a search engine, but this incident was discovered in time by the security team, preventing a major disaster. However, engineer A's position and related colleagues on the wallet infrastructure team were already exposed to the hacker at that time. In summary, this was a multi-stage attack: combining fake interviews, malware downloads, exploitation of internal AI tools, compromise of endpoint devices, and advanced transaction authorization techniques. The LinkedIn exposure of Binance employees' identities was merely the surface; the root cause lay in A downloading a tampered tool, allowing hackers to lock onto the wallet team, and B running an "interview assignment" on a work computer, directly opening the door to their network. Internal AI tools became a springboard for lateral movement, allowing the hackers to spread from one computer to three core wallet engineers. Furthermore, the EIP-7702 authorization and the difficulty of quickly revoking the MPC wallet's authorization meant the incident wasn't fully contained within nearly four hours, acting as a catalyst.