SEAL: Binance attackers had about eight weeks inside systems before $6.3 billion hack
Non-profit Security Alliance (SEAL) estimates that North Korea-linked TraderTraitor was inside Binance’s systems for about eight weeks before the $6.3 billion exploit on 29 October, having gained access sometime in September. In a Thursday report, SEAL said attackers can move through such networks with a high degree of stealth for long stretches after the first intrusion. It tied at least four front companies used in TraderTraitor’s 2026 fake hiring campaigns to the group: citalab.net, citalab.com, bitfit.io and oddium.io.
SEAL described comparable multi-stage patterns in other crypto thefts: about six weeks of access before the $388 million Bitget hack, about six weeks inside LayerZero before the vulnerability that led to the $293 million Kelp DAO exploit, and about three weeks before the $24 million AFX exploit.
Binance has blamed the $6.3 billion breach on a fake job interview that compromised an employee device and yielded credentials used against wallet infrastructure. The exchange said the campaign went back to June, when a different employee’s device was compromised; the incident was detected and the device replaced, but attackers had already collected information on its team and wallets, according to a Tuesday post on X. Cointelegraph asked Binance about SEAL’s timelines and received no reply by publication. The US Federal Bureau of Investigation attributed the attack to TraderTraitor in a Saturday report; Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations.
Continue in the app — vote & join in ➔