Binance hackers lurked for 8 weeks pre-hack
SEAL finds North Korea-linked hackers held device access for 8 weeks before Binance's $6.3B exploit, matching a pattern across recent heists.
Security Alliance says North Korea-linked hackers sat inside a Binance employee's device for roughly eight weeks before the exchange's $6.3 billion exploit on Oct. 29. Binance disputes the timeline's framing but confirms the broader campaign started even earlier, in June, with wallet-infrastructure access only achieved on Oct. 20.
The intrusion timeline
SEAL and Binance agree on the mechanics even as they argue over the clock. A software engineer's device was compromised in September through a fake recruitment scheme; a separate employee's machine was hit in June via a tampered Homebrew install.
- SEAL estimates an eight-week window between the September compromise and the Oct. 29 exploit.
- Binance says the campaign traces to June, but attackers didn't reach wallet infrastructure until Oct. 20, nine days before the exploit.
- SEAL found four front companies tied to the same TraderTraitor recruitment scheme in 2026, including citalab.net and oddium.io.
- The same group held about six weeks of access before the $388 million Bitget hack and six weeks before the $293 million Kelp DAO exploit.
- A separate $24 million AFX exploit followed roughly three weeks of prior access, per SEAL's analysis.
What the pattern shows
The default read treats each heist as a one-off failure of a single exchange's defenses. SEAL's data makes it a repeatable playbook: compromise a device, wait weeks inside the network, then strike once wallet-level access is found.
Six to eight weeks shows up across Bitget, Kelp DAO and Binance. That's not coincidence, it's a production process.
The attackers aren't racing the clock. They're patient enough to sit inside four different targets for over a month each before pulling the trigger, which means detection windows exist and are being missed.
Binance's own account supports this. The June compromise was caught and the device was replaced, credentials rotated, yet the attackers had already harvested information about wallet-team staff that resurfaced in September's breach.
Containing one device doesn't contain the campaign once reconnaissance data is out.
The stakes for exchanges
Every exchange running centralized wallet infrastructure is a target for the same multi-stage approach: fake recruiter outreach, a compromised laptop, then weeks of lateral movement before the exploit. SEAL's four-heist sample puts total losses tied to this one method near $7 billion.
That's a methodology problem, not a Binance-specific lapse. Fixing it means screening for the September-to-October pattern across the industry, not auditing one exchange's logs after the fact.
What to watch
- Whether Binance's forensic report names the specific deployment-permission token exploited on Oct. 20 and when it was created.
- Whether other exchanges disclose device compromises in the June-September window matching the same recruitment-scheme signature.
- Whether SEAL or the FBI link additional 2026 exploits to the same four front companies identified in this report.