According to The Block, citing Binance's preliminary investigation report, attackers targeted a Wallet DevOps engineer in June via a tampered Homebrew installation package. Binance stated that after its security team detected anomalies, they replaced the device and rotated affected credentials, but the incident exposed the engineer's position and colleagues' information. The attackers then infected another employee's work computer in September using a fake job offer and, on October 20, leveraged that computer and internal AI tools to gain control of two other engineers' devices, discovering container deployment permissions. The report states that on October 29, the attackers used stolen credentials to deploy containers and run malicious scripts to launch a wallet attack. Binance said it has closed the attack vector and rebuilt or replaced affected systems.