The document claims that the hacker managed to take over Bitmain’s account. Instead of immediately trying to withdraw the funds - which could’ve triggered Binance’s security systems – the hacker used two other accounts on Binance and one on Bittrex to pull off the heist.