It's unlikely an engineer would have direct access to anything. That should be at least behind multisig. But you never know, people do dumb shit and there might have been critical private keys mounted in some random container from a subsystem made 6 years ago that was never replaced or tracked because it never made noise.

I don't work at Binance, but having been in that exact situation (SRE @ Crypto company with lots of assets, attacked by North Koreans), I'm guessing DevOps guy gave access to some CI/CD, `kubectl exec` what have you which allowed attackers to play with APIs, some settlement mechanic, some smart contract update pipeline. You don't really have to attack wallets if something less secure controls them. This really could stem from nothing, excessive permissions in a GitHub token can go very leveraged properly.