Binance's $6.3 Billion Theft Demonstrated: Hackers Infiltrated the Company with a Fake Interview Yesterday, Binance released its preliminary investigation report on the theft, outlining the five-step process spanning several months. We've created an animated demonstration below 1️⃣ In June, Binance wallet team engineer A downloaded a modified AI programming tool installation package. His computer was quickly replaced, but his job title and colleagues' information had already fallen into the hacker's hands. 2️⃣ In September, another engineer, B, received an interview invitation on a job search platform. A "HR" person appeared via video to gain his trust. During the second interview, he was asked to download an "assignment" on his work computer; malicious code ran automatically, undetected by security software. 3️⃣ On October 20th, the hacker used Binance's internal AI tools to jump from B's computer to the computers of A and another engineer, C. On A's computer, they found a token that could deploy containers. 4️⃣ On the evening of October 29th (UTC time), the hacker logged into C's computer, deployed a container using A's token, ran a malicious script, and gained wallet signing permissions. 5️⃣ Subsequently, XRP, SOL, OP, and BTC were transferred out in batches. The hacker also used EIP-7702 to authorize their own contract on-chain. This channel bypassed Binance's withdrawal system, and even suspending withdrawals couldn't stop it. The last transfer didn't occur until 07:56 Beijing time on October 30th, and Binance cleared the relevant authorizations at 08:10, taking approximately 4 hours to completely stop the situation. Currently, $2.85 billion has been frozen or intercepted, and Binance stated that the platform will bear the losses.