SEAL Estimates Binance Attacker Had Access for Eight Weeks Before $6.3 Billion Attack

Security Alliance (SEAL) estimates an attacker accessed Binance’s systems for about eight weeks before the Oct. 29, $6.3 billion attack, pointing to a prolonged intrusion at the crypto exchange.

SEAL places the initial compromise in September and says the attacker remained hidden after entering Binance’s systems. Binance has linked the incident to a fake job interview that allowed the attacker to take control of an employee’s device and steal credentials for the exchange’s wallet infrastructure. Binance also traced activity to June, when a different employee’s device was compromised.

The FBI attributed the attack to TraderTraitor, which SEAL describes as a North Korea-linked group. SEAL also connected TraderTraitor to at least four shell companies associated with fake recruitment activity in 2026: citalab.net, citalab.com, bitfit.io and oddium.io.

SEAL estimated similar access windows around other incidents: about six weeks before a Bitget attack, about six weeks of access to LayerZero before a Kelp DAO attack, and about three weeks before an AFX attack.