According to CoinMeta, Wu said that based on the preliminary investigation report released by Binance, a complete timeline of the attack was compiled: In June, wallet operations engineer A downloaded a tampered homebrew installation program in order to install the AI programming tool. Although the security team detected the anomaly and replaced the equipment as well as rotated the credentials, the information of A’s position and related colleagues had already been exposed. In September, software engineer B was induced to download a code repository containing malicious code during a fake recruitment interview, which led to the intrusion of their work computer. On October 20th, the attackers used B’s compromised computer and internal AI tools to further control engineers A and C, and discovered the container deployment permission tokens on A’s computer. On October 29th, the attackers logged into C’s computer, deployed containers using the credentials stolen from A, and executed malicious scripts. Subsequently, they carried out asset transfers through the unauthorized access to the internal wallet signing service.