Security Alliance (SEAL) estimated that North Korea-linked hackers compromised a Binance employee’s device about eight weeks before the exchange’s Oct. 29, 2026, $6.3 billion exploit. Binance’s clarification draws an important distinction: the broader campaign began in June, but attackers did not gain the access needed to reach wallet operations until Oct. 20.
Source publication: Nov. 6, 2026, at 19:26:30 UTC+8. Cointelegraph’s supplied article includes a correction dated Nov. 6 at 17:03 UTC, clarifying the timeline and adding Binance’s response.
How the intrusion developed
The accounts describe several stages rather than eight weeks of continuous access to wallet infrastructure:
- June: According to Binance, an employee downloaded a tampered Homebrew installation while trying to install an AI coding tool. The exchange detected the compromise, replaced the device and rotated related credentials. However, attackers had already obtained information about employees working on its wallet infrastructure.
- September: A fake recruitment scheme compromised a software engineer’s device, according to SEAL’s Thursday report. SEAL’s roughly eight-week estimate concerns this September-to-October intrusion window, not the start of the broader campaign.
- Oct. 20: Binance said attackers used the September-compromised computer and an internal AI tool to gain control of two wallet infrastructure engineers’ devices. They then discovered a deployment permission token.
- Oct. 29: That token was used during the $6.3 billion exploit, according to Binance.
A Binance spokesperson told Cointelegraph that the initial device compromises occurred in June and September, but that attackers only gained the access needed to reach wallet operations on Oct. 20, when they moved laterally to additional devices and credentials.
What SEAL’s findings show—and what they do not
SEAL warned that attackers can navigate compromised systems with a “high degree of stealth over prolonged periods of time.” It identified at least four alleged front companies associated with TraderTraitor’s fake recruitment campaigns in 2026: citalab.net, citalab.com, bitfit.io and oddium.io.
The organization also estimated lengthy intrusion periods in other crypto attacks: about six weeks before the $388 million Bitget hack, six weeks of access to LayerZero before the vulnerability that led to the $293 million Kelp DAO exploit, and about three weeks before the $24 million AFX exploit.
These are SEAL’s estimates. In Binance’s case, the eight-week figure should not be read as eight weeks of access to wallet operations; the exchange places that access at Oct. 20.
The US Federal Bureau of Investigation attributed the Binance attack to North Korea’s TraderTraitor in a Saturday report. Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations.