It started with a recruiter who did not exist. Binance's initial incident report, published November 3 and summarized by TheStreet, traces the $6.34 billion theft back about five months. In June, a wallet DevOps engineer installed a tampered copy of Homebrew while looking for an AI coding tool; Binance caught it and replaced his laptop, but the attackers had already learned who he was and who sat near him. In September, a second engineer was approached on a job site by someone posing as a project director, sat through a video interview with a fake HR representative and a chat with the CEO of a company that does not exist, and then downloaded a coding "assignment" to his work computer. It swapped his pyenv Python tool for a malicious copy, a zero-day that Binance's endpoint protection missed. On October 20 the attackers used that machine and an internal Binance AI tool to take over two more engineers' computers and lift a deployment token. On October 29 they logged in at 17:15 UTC, finished setup at 19:56 and began moving funds at 20:05. Freezing withdrawals did not stop them, because an EIP-7702 delegation gave their contract on-chain control of the Binance14 hot wallet until Binance revoked it at 00:10 UTC on October 30. "This should not have happened," the report says. Changpeng Zhao told Yahoo Finance: "There's no 100% security."