$6.3B Binance Hack: Attackers Had 8 Weeks of Access, SEAL Says

North Korea-linked attackers behind the reported $6.3 billion Binance exploit likely had access to the exchange’s systems for approximately eight weeks, according to cybersecurity nonprofit Security Alliance (SEAL). The group reportedly entered Binance’s environment in September, nearly two months before the Oct. 29 attack, and was able to operate with “a high degree of stealth” after gaining initial access.

SEAL linked the intrusion to the TraderTraitor group and identified four front companies connected to its fake recruitment campaigns in 2026: citalab.net, citalab.com, bitfit.io and oddium.io. Binance has attributed the attack to a fake job interview that compromised an employee device and exposed credentials used to breach its wallet infrastructure.

SEAL also identified similar multi-stage intrusion patterns in other major crypto incidents. Attackers reportedly maintained access for about six weeks before the $388 million Bitget hack, six weeks before a LayerZero vulnerability led to the $293 million Kelp DAO exploit, and three weeks before the $24 million AFX exploit.

The FBI has attributed the Binance attack to North Korea’s TraderTraitor, although Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the allegations. Binance said it detected and replaced a separate employee device compromised in June, but attackers had already collected information about the company’s team and wallet infrastructure. Cointelegraph did not receive a response from Binance regarding SEAL’s access estimates by publication time.