Binance Hackers Had 8 Weeks Inside Systems Before $6.3B Exploit

Hackers linked to North Korea's TraderTraitor group had roughly eight weeks of access to Binance's internal systems before executing the $6.3 billion exploit on Oct. 29, according to an estimate published Thursday by the nonprofit cybersecurity organization Security Alliance (SEAL).

SEAL's analysis places the initial intrusion sometime in September. Once inside, the report said, threat actors can move through these systems with a "high degree of stealth over prolonged periods of time." That dwell time — the gap between breach and theft — is emerging as a defining feature of the recent wave of state-linked crypto heists.

What did SEAL find beyond Binance?

The organization's report identified a consistent multi-stage intrusion pattern across several high-profile hacks:

• About six weeks of attacker access before the $388 million Bitget hack
• Roughly six weeks of access to LayerZero before the vulnerability that enabled the $293 million Kelp DAO exploit
• Around three weeks of access before the $24 million AFX exploit

SEAL also named at least four "front companies" tied to TraderTraitor's fake recruitment campaigns in 2026: citalab.net, citalab.com, bitfit.io and oddium.io. The domains suggest the group continues to run employment-lure operations — the same social-engineering vector Binance says opened the door to its own breach.

How did the Binance intrusion actually start?

Binance has attributed the $6.3 billion hack to a fake job interview. In that scenario, attackers compromised an employee device and stole credentials, which they then used to breach the exchange's wallet infrastructure.

The exchange traced the broader campaign back to June, when a separate employee's device was compromised, according to a Tuesday post on X. Binance detected that earlier incident and replaced the device. But the company said attackers had already gathered information about its team and wallet architecture before the compromise was caught — intelligence that plausibly fed the October operation.

That timeline matters. If SEAL's estimate holds, the June device compromise, the September system access and the Oct. 29 exploit form a single extended campaign rather than isolated incidents. Each stage compounded: initial foothold, reconnaissance of wallet infrastructure, then extraction.

Cointelegraph contacted Binance for comment on SEAL's estimates but had not received a response by publication.

Who does law enforcement blame?

The US Federal Bureau of Investigation attributed the attack to TraderTraitor, a hacking cluster linked to North Korea, in a report published Saturday. Kim Yo Jong, sister of North Korean leader Kim Jong Un, has dismissed the accusation.

The attribution aligns with a well-documented pattern. TraderTraitor operations typically rely on fabricated recruiter personas, booby-trapped job documents and prolonged credential harvesting — exactly the playbook SEAL describes across the Binance, Bitget, Kelp DAO and AFX incidents.

Why dwell time changes how exchanges defend themselves?

The SEAL findings reframe the security problem for major exchanges. If attackers sit inside systems for six to eight weeks undetected, perimeter defenses and single-device remediation aren't enough. Binance replaced the compromised device in June, yet the intrusion chain continued.

The operational lesson is detection speed inside the network, not just at the edge. Exchanges now face adversaries who treat recruitment fraud as long-horizon infrastructure work — registering front companies, nurturing targets and mapping wallet systems weeks before touching funds.

The four named domains give compliance and security teams concrete indicators to screen against, and the FBI's formal attribution opens the door to further US enforcement action against the TraderTraitor cluster.