The attackers utilized a multi-faceted approach, starting with a compromised engineer's laptop to gain access to service containers. On Ethereum, they leveraged the EIP-7702 delegation feature to turn a hot wallet into a sweeper using pre-signed authorizations, while performing simultaneous, rapid transfers across nine other blockchains.