The theft took 4 minutes, the setup took 5 months. Binance's incident report traces it to a poisoned Homebrew install in June and a fake job interview in September that put a 0-day on a work laptop.

On October 20, an internal AI tool led the attackers to two wallet engineers and a deploy token. On October 29, 233M XRP left the hot wallets, followed by SOL, OP and 18,270 BTC.

Pausing withdrawals didn't stop it: an EIP-7702 delegation kept moving funds on-chain for ~4 hours, until it was cleared at 00:10 UTC.

$2.85B is frozen, and the FBI names North Korea's TraderTraitor.