according to Binance's own account so far, the first statement said it “may involve a compromised DevOps engineer’s laptop” that gave the attacker access to a service container to submit withdrawals. then on Friday, Richard Teng said the attacker “did not simply use one engineer’s permissions”, that they’d found additional points of breach, and malware built to destroy itself and its traces.

they also say there’s no evidence any private key leaked yet their own signing system signed the transfers.