Embedded messages attached to transactions sent to the Binance attacker wallets included phishing links mimicking THORChain swap sites, promotions for the $NST token, and requests for treats.