According to a publicly released Binance report, the attack on Binance was a meticulously planned short drama, chilling to contemplate. The attack was planned over approximately four months, serving as a stark reminder that individuals and companies should prioritize security. Below is the complete process of the hacker's plan: Chapter 1: The Bait (June 2026) Engineer A from the Wallet DevOps team wanted to install a popular AI coding tool. He found a tutorial on a search engine and followed the steps to install it using Homebrew. However, the Homebrew package had been tampered with beforehand. Malware silently landed on his work computer. The Binance security team quickly detected the anomaly, immediately replacing the device and rotating all related credentials. The crisis seemed averted. But the hackers had already memorized Engineer A's role and the names of his colleagues—key personnel on the wallet infrastructure team—and were now in their sights. Chapter 2: The Phishing Interview (September 2026) A few months later, software engineer B received a message on a legitimate job search platform. The interviewer claimed to be a Project Director for a project, and their background seemed very authentic. The first round was a video interview. The fake HR even shared their social media accounts, which included photos and videos, making them appear very "real." The second round was conducted on a commonly used social chat software. Near the end of the interview, the interviewer said, "This is our technical assignment. Download this code repository to your computer and run it." Engineer B executed the installation on their work computer. The malicious code in the repository immediately started. It disguised itself as a legitimate development tool component, replaced files like pyenv, and established covert communication with an external server. This was a zero-day vulnerability that even endpoint protection couldn't detect at the time. The hackers also cleaned up their tracks, making subsequent investigations more difficult. Chapter 3: Lateral Movement (Around October 20th) After gaining control of Engineer B's computer, the hackers discovered an AI tool within Binance that could be used as a springboard. Through this channel, they further gained control of Wallet DevOps engineer A and another wallet software engineer C. On Engineer A's computer, they found a crucial item—a token for container deployment permissions. Chapter 4: The Crackdown (October 29th) Between 5:15 PM and 7:56 PM, the hackers logged into Engineer C's computer. Using credentials stolen from Engineer A, they deployed a malicious container and triggered an attack script. The target was Binance's internal wallet signing service. With unauthorized access, the attackers could bypass the normal withdrawal process and directly initiate signed transactions. That evening's fund transfers, 8:05 PM–8:09 PM: Five hot wallets transferred out 233.46 million XRP. Subsequently, the Solana and Optimism hot wallets transferred out approximately 970,500 SOL and 44.2 million OP. Then, 18,270 BTC were transferred out. More importantly, they exploited Ethereum's EIP-7702 mechanism to set partial execution permissions on-chain for a smart contract controlled by the attackers. Once this authorization is written to the blockchain, even if Binance suspends withdrawals, it won't stop it.