Comment by Lalabadie

The researcher who uncovered today's Claude Code extensions backdoor confirmed that Binance were using said extensions through Cursor.

That means one of the working hypotheses is the threat actors had direct SSH access to Binance machines/environments.