Binance Hackers Had 8 Weeks Access Before $6.3B Exploit, Alliance Says

Security Alliance (SEAL), a non-profit cybersecurity organization, says the North Korea-linked threat actor TraderTraitor likely obtained access to Binance’s systems in September—roughly eight weeks before Binance revealed it suffered a $6.3 billion exploit on Oct. 29. In an analysis published Thursday, SEAL argues that the intrusion began months earlier than the public incident timeframe would suggest, giving attackers time to operate quietly and map internal controls.

SEAL further links TraderTraitor to a network of front companies used during 2026 recruitment-style scams, identifying at least four domains associated with the campaign. The organization’s findings also emphasize a recurring pattern seen across major crypto breaches: multi-stage access that can persist for weeks before funds are ultimately drained.

Key takeaways

• SEAL estimates TraderTraitor gained access to Binance systems in September, about eight weeks before the Oct. 29 $6.3 billion exploit.
• The report suggests attackers maintained “high degree of stealth” after initial intrusion, enabling prolonged internal navigation.
• SEAL identified at least four 2026 “front companies” tied to TraderTraitor recruitment campaigns: citalab.net, citalab.com, bitfit.io, and oddium.io.
• SEAL points to similar timelines in other crypto hacks, suggesting attackers commonly hold access for weeks prior to exploitation.
• Binance attributed the hack to a fake job interview that compromised an employee device and led to stolen credentials; Binance has said the campaign traced back to June.

Early access may extend far beyond the headline breach

SEAL’s central claim is that the operational compromise of Binance did not start at the time of the public exploit. In the Thursday report, the group wrote that TraderTraitor’s intrusion into Binance’s systems likely began in September and that threat actors could remain inside with significant stealth for extended periods.

That matters for defenders and market participants because the “incident date” often becomes the only publicly visible milestone. If attackers can linger in systems for weeks before executing a high-impact breach, then the real window of exposure may involve internal monitoring, credential hygiene, and access control weaknesses that may not be evident until after the damage is done.

Connections to recruitment scams and infrastructure

SEAL also said it identified at least four “front companies” connected to TraderTraitor’s fake recruitment campaigns in 2026. The domains cited in the analysis—citalab.net, citalab.com, bitfit.io, and oddium.io—are presented as part of the broader effort to establish credibility, lure victims, and set up pathways into target organizations.

This line of analysis aligns with what Binance has described publicly. Earlier reporting referenced by SEAL indicates Binance attributed the $6.3 billion hack to a fake job interview, which enabled attackers to compromise an employee device and steal credentials used to breach the exchange’s wallet infrastructure.

How SEAL says this matches other major crypto hacks

Beyond Binance, SEAL used other high-profile incidents to argue that multi-stage intrusion is a repeatable feature of large-scale crypto attacks. The organization estimated approximate access windows before exploitation in several cases, including:

• About six weeks of access prior to the $388 million Bitget hack.
• About six weeks of access to LayerZero before the vulnerability that led to the $293 million Kelp DAO exploit.
• About three weeks before execution in the $24 million AFX exploit.

While timelines differ by incident, the shared thread is that compromise can precede exploitation by weeks. In practice, that shifts the security conversation away from purely incident-response readiness and toward earlier detection—such as recognizing sustained attacker presence, abnormal access patterns, and credential exposure long before assets are moved.

Binance’s account and the broader attribution debate

SEAL’s estimates prompted questions about when and how the intrusion began, and Cointelegraph attempted to verify the analysis by contacting Binance for comment. Cointelegraph reported that Binance did not respond by publication.

Binance has previously described a different sequence of events. According to Binance, it traced the attack campaign back to June, when another employee device was compromised. Binance said it detected that earlier intrusion and replaced the device, but added that attackers may have already collected information about staff and Binance’s wallet infrastructure. Binance also pointed to the fake job interview mechanism as the route that ultimately enabled the exploit, which was publicly detailed after the Oct. 29 incident.

Attribution has also been contested at the geopolitical level. The U.S. Federal Bureau of Investigation attributed the attack to North Korea’s TraderTraitor in a Saturday report, while Kim Yo Jong—sister of North Korean leader Kim Jong Un—dismissed the accusations, according to earlier coverage cited by Cointelegraph.

Taken together, the dispute highlights a familiar asymmetry in cyber incidents: investigators and affected organizations may emphasize different phases of the same attack chain (initial foothold versus credential theft versus final wallet breach). SEAL’s contribution is to focus on likely system access timing and how long attackers may have been inside before the public exploit date.

Readers watching this story next should focus on whether additional technical details emerge that reconcile the June compromise timeline described by Binance with SEAL’s September system-access estimate, and whether similar “weeks-long access” patterns become more visible in future reporting across other exchange and protocol incidents.