Binance released its preliminary investigation report, and even a lighthearted novel wouldn't dare write such a thing—the North Korean hackers are just too damn awesome. After reading the entire report, what struck me most was the timeline. The hackers scouted the area in June, attacked in September, obtained the tokens on October 20th, and launched their attack on October 30th. Each step was preceded by patient waiting. They didn't touch firewalls, didn't crack passwords, they only studied people. Binance has blocked 57 suspected North Korean hacker attacks this year, and the 58th one succeeded. 01) In June of this year, an engineer on the Binance wallet team wanted to install an AI programming tool. He opened a search engine and downloaded the top-ranking installation package. The installation package was fake. The hackers had used a modified version in search ads, and it ranked higher than the real one. The Binance security team detected the anomaly, changed the equipment, and rotated the credentials—their response wasn't slow. But one thing couldn't be recovered: the engineer's job information, along with the entire wallet team's roster, had been exposed. 02) In September, a second net was cast on another engineer. He publicly posted his resume on a job search platform, stating he worked for Binance. A person claiming to be a project director contacted him, saying they wanted to discuss a position. In the first round of interviews, an HR person video-called him, showing their face and even sending him their social media accounts, which included photos and videos of their daily life—they seemed like a real person. The second round switched to a chat app, and the person on the other end claimed to be the company's CEO. The company didn't exist. The HR person didn't exist. The CEO didn't exist. The entire interview was a charade, with only one audience member. Near the end of the interview, the other party sent a technical test. The engineer downloaded and ran it on his work computer. The code secretly did something during the installation phase: it replaced the computer's development tool, pyenv, with a version containing a malware, connected back to the hacker's server, and then cleaned up its own traces. This was a zero-day sample, which Binance's endpoint protection at the time failed to detect. 03) On October 20th, the hacker started from this computer, using an AI tool within Binance to move laterally and gain control of the computers of two other wallet engineers. They also discovered a token granting container deployment permissions on one of these computers. 04) At 1:15 AM on October 30th, the hacker logged into a third computer, used the stolen credentials to deploy a container, and executed a script. At 4:05 AM, five hot wallets began transferring funds outwards. Within four minutes, 233 million XRP were withdrawn, followed by approximately 970,000 SOL, 44.2 million OP, and 18,270 Bitcoin. Binance received an alert and suspended withdrawals. However, the money continued to flow. The hacker used Ethereum's EIP-7702 mechanism to establish authorization on-chain with 50 signed transactions. This authorization, written on the blockchain, bypassed Binance's withdrawal system, and shutting down the service could not stop it. The hot wallet used MPC technology, and without a private key that could immediately revoke authorization, the team had to write a revocation procedure on the spot. The last unauthorized transfer was confirmed at 7:56 AM. In nearly four hours, $6.34 billion was involved. To be fair, Binance didn't do too badly this time. They immediately replaced the equipment upon discovering the anomaly, provided full compensation after the incident, replenished 98% of the affected tokens, and proactively made the report public for industry-wide reference. However, this exchange, one of the world's most heavily defended, ultimately lost to a job interview. The report didn't name the job search platform. But on platforms like LinkedIn, there are still thousands of resumes listing Binance, Coinbase, and various crypto institutions. For hackers, that's a menu. The next interview invitation is probably already on its way.