Binance hackers had 8-week intrusion window before $6.3B exploit: SEAL

Updated (Nov. 6 at 05:03 p.m. UTC): This article has been corrected to clarify the timeline of the Binance hack. The article also includes a statement from a Binance spokesperson.

Nonprofit cybersecurity organization Security Alliance (SEAL) estimates that North Korea-linked hackers compromised a Binance employee’s device about eight weeks before the exchange’s $6.3 billion exploit on Oct. 29, although Binance said the broader attack campaign began in June and that the hackers did not gain access to additional wallet infrastructure devices until Oct. 20.

The hacking group compromised a Binance software engineer’s device in September through a fake recruitment scheme, wrote SEAL in a Thursday report, adding that threat actors can navigate compromised systems with a “high degree of stealth over prolonged periods of time” after initial intrusion. SEAL’s eight-week estimate refers to the September-to-October intrusion window, rather than the beginning of the broader campaign described by Binance.

Cointelegraph contacted Binance for clarification on the timeline. A spokesperson said the initial device compromises occurred in June and September, but that attackers did not gain the access needed to reach wallet operations until Oct. 20.

“As outlined in our announcement, the initial device compromises occurred in June and September, but the attackers did not gain the access needed to reach wallet operations until October 20, when they used that foothold to move laterally and obtain access to additional devices and credentials,” the spokesperson said.

SEAL identified at least four “front companies” associated with TraderTraitor’s fake recruitment campaigns in 2026, including citalab.net, citalab.com, bitfit.io and oddium.io. 

Binance traced the attack campaign back to June, when a separate employee’s device was compromised after the employee downloaded a tampered Homebrew installation while attempting to install an AI coding tool. The exchange detected the incident and replaced the device, rotating related credentials. However, the attackers had already obtained information about employees working on Binance’s wallet infrastructure, according to a Tuesday X post.

On Oct. 20, attackers used the compromised computer of the engineer targeted in September and an internal AI tool to gain control of two wallet infrastructure engineers’ devices, according to Binance. They subsequently discovered a deployment permission token, which was used during the Oct. 29 exploit.

The cybersecurity organization’s analysis pointed to similar multi-stage intrusion patterns in other high-profile crypto hacks. It estimated that attackers had about six weeks of access before the $388 million Bitget hack, six weeks of access to LayerZero before the vulnerability that led to the $293 million Kelp DAO exploit and about three weeks before conducting the $24 million AFX exploit. 

The US Federal Bureau of Investigation attributed the attack to North Korea’s TraderTraitor, in a Saturday report. Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations.

Related: Binance hack may be ‘temporary setback’ for crypto, Grayscale’s Pandl says