Binance hackers had 8 weeks of access before $6.3B exploit, Security Alliance estimates
North Korea-linked TraderTraitor gained access to Binance's systems about eight weeks before the $6.3 billion exploit on October 29, according to Security Alliance.
The cybersecurity company flagged similar multi-stage intrusion patterns behind other high-profile crypto heists, including the $388 million Bitget hack. SEAL wrote in a Thursday report that the threat actors can navigate these systems with a "high degree of stealth over prolonged periods of time" after initial intrusion.
Front companies identified
SEAL identified at least four "front companies" associated with TraderTraitor's fake recruitment campaigns in 2026, including citalab.net, citalab.com, bitfit.io and oddium.io. The organization's analysis pointed to similar multi-stage intrusion patterns in other major crypto hacks.
Binance's response
Binance attributed the $6.3 billion hack to a fake job interview that enabled hackers to compromise an employee device and steal credentials to breach the exchange's wallet infrastructure. The exchange traced the attack campaign back to June, when a separate employee's device was compromised.
The exchange detected the incident and replaced the device, but said that attackers had already gathered information about its team and wallet infrastructure.
North Korean connection
The US Federal Bureau of Investigation attributed the attack to North Korea's TraderTraitor, in a Saturday report. Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations.
Related
