Binance's $6.3 Billion Theft Demonstrated: Hackers Infiltrated the Company with a Fake Interview Yesterday, Binance released its preliminary investigation report on the theft, outlining the entire process in five steps spanning several months. We've created an animation of it below 1️⃣ In June, Binance wallet team engineer A downloaded a modified AI programming tool installation package. His computer was quickly replaced, but his job title and colleagues' information had already fallen into the hacker's hands. 2️⃣ In September, another engineer, B, received an interview invitation on a job search platform. A "HR" person appeared via video to gain his trust. During the second interview, he was asked to download an "assignment" on his work computer; malicious code ran automatically, undetected by security software. 3️⃣ On October 20th, the hacker used Binance's internal AI tools to jump from B's computer to the computers of A and another engineer, C. On A's computer, they found a token that could deploy containers. 4️⃣ On the evening of October 29th, the hacker logged into C's computer, used A's token to deploy a container, run a malicious script, and gain wallet signing permissions. 5️⃣ That same night, XRP, SOL, OP, and BTC were transferred out in batches. The hacker also used EIP-7702 to authorize their own contract on-chain. This channel bypassed Binance's withdrawal system, and even suspending withdrawals couldn't stop it; the last transfer wasn't completed until 23:56. Currently, $2.85 billion has been frozen or intercepted, and Binance stated that the platform will bear the losses.