SEAL Puts Binance Device Compromise About Eight Weeks Before $6.3 Billion Exploit

Security Alliance (SEAL) estimates that a Binance software engineer’s device was compromised in September, about eight weeks before the exchange’s $6.3 billion exploit on Oct. 29.

SEAL’s estimate covers the September device intrusion, rather than the start of Binance’s wider campaign. Binance says separate employee devices were compromised in June and September, and attackers did not reach systems needed for wallet operations until Oct. 20. The eight-week span runs from the September foothold to the Oct. 29 exploit. It adds a later checkpoint to Binance co-CEO Richard Teng’s earlier account of the intrusion timeline, which put its beginning in June.

SEAL says the September compromise came through a fake recruitment approach. It also identified at least four front companies tied to TraderTraitor’s fake hiring campaigns during 2026: citalab.net, citalab.com, bitfit.io and oddium.io. SEAL described attackers as able to stay active in compromised systems for extended periods while avoiding attention.

Binance traced the June incident to a wallet DevOps engineer who downloaded a tampered Homebrew installation while trying to set up an AI coding tool. The exchange says it detected the intrusion, replaced the affected computer and rotated related credentials, but attackers had already gathered information about employees working on wallet infrastructure.

Binance says attackers moved from the September engineer’s computer on Oct. 20, using an internal AI tool to compromise two wallet infrastructure engineers’ devices. They then found a deployment permission token that Binance says was later used in the Oct. 29 exploit.

The Federal Bureau of Investigation (FBI) attributed the Binance attack to North Korea-linked TraderTraitor.

SEAL put the attackers’ access ahead of the $388 million Bitget hack at roughly six weeks. It estimated a similar period at LayerZero before the vulnerability tied to the $293 million Kelp DAO exploit. It put the lead-up to the $24 million AFX exploit at about three weeks. SEAL described the cases as similar multistage patterns in other high-profile crypto hacks.