Binance hackers had eight weeks of access before $6.3B heist, security firm estimates
North Korea-linked TraderTraitor group likely infiltrated systems in September, says Security Alliance, detailing multi-stage intrusion similar to other high-profile crypto exploits
Non-profit cybersecurity organization Security Alliance (SEAL) estimates that North Korea-linked hackers had access to Binance’s systems for about eight weeks before the $6.3 billion exploit on Oct. 29, with the group gaining access sometime in September.
Security Alliance (SEAL) released a report Thursday estimating that the hacking group TraderTraitor gained access to Binance's systems in September, about eight weeks before the $6.3 billion exploit. The FBI attributed the attack to North Korea’s TraderTraitor. SEAL wrote that threat actors can navigate these systems with a “high degree of stealth over prolonged periods of time” after initial intrusion.
The cybersecurity organization identified at least four “front companies” associated with TraderTraitor’s fake recruitment campaigns in 2026: citalab.net, citalab.com, bitfit.io, and oddium.io. SEAL’s analysis pointed to similar multi-stage intrusion patterns in other high-profile crypto hacks, including about six weeks of access before the $388 million Bitget hack, six weeks of access to LayerZero before the vulnerability leading to the $293 million Kelp DAO exploit, and about three weeks before the $24 million AFX exploit.
Binance earlier revealed that hackers used fake job interviews and a compromised internal AI tool, calling it a “serious and highly sophisticated security incident.” In a post on X, Binance said one of its engineers was contacted through a legitimate job-hunting platform and invited to bogus job interviews with fake company representatives, who used “more advanced and deceptive” methods to build trust, including sharing social media accounts with personal images. The engineer was instructed to download malware masquerading as an “assignment” during a second interview, which deployed malicious code with obfuscation techniques evading detection. Hackers then leveraged the engineer's compromised computer and a compromised internal AI tool in October to gain control over two other engineers' laptops, executing the next steps of the attack.
Binance traced the campaign back to June, when a separate employee’s device was compromised; the exchange detected the incident and replaced the device, but said attackers had already gathered information about its team and wallet infrastructure. The exchange apologized, saying “this should not have happened,” and noted that 98% of affected token assets had been replenished as of Saturday, with over 100% of funds set aside to cover the loss. The FBI, Secret Service and other agencies have been assisting Binance.
Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations as another “sinister attempt” by the US to damage North Korea’s public image, in a statement Tuesday. North Korea has consistently denied involvement in major cyber attacks it has been blamed for in recent years. TraderTraitor, also known as the Lazarus Group, was blamed for the then-record $1.5 billion Bybit hack in 2025.
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.
Estimated access time before crypto hacks, according to Security Alliance
weeks
Estimated duration of attacker access before each exploit was detected. Source: Security Alliance (SEAL) report, as cited in Cointelegraph
§
Analysis
Why This Matters
The $6.3 billion hack is the largest crypto theft to date, highlighting persistent vulnerabilities in even major exchanges' security systems and the sophistication of state-backed hacking groups.
The estimated eight-week undetected access window raises serious questions about internal monitoring and response capabilities at Binance and other platforms that handle billions in user assets.
North Korea's alleged involvement underscores ongoing concerns about state-sponsored cybercrime funding illicit activities, as similar patterns emerge across multiple high-profile exploits.
Background
Binance, the world's largest cryptocurrency exchange, suffered a $6.3 billion hack on Oct. 29, 2026, in which attackers drained billions from its own wallets. The company attributed the breach to a sophisticated social engineering campaign involving fake job interviews and compromised AI tools. The US Federal Bureau of Investigation linked the attack to North Korea's TraderTraitor group, also known as the Lazarus Group, which was blamed for the $1.5 billion Bybit hack in 2025. North Korea has denied involvement. Security Alliance is a non-profit cybersecurity organization that tracks and analyzes crypto-related threats.
Key Perspectives
Security Alliance (SEAL): Estimates hackers had about eight weeks of access before the exploit, beginning in September, and notes similar multi-stage intrusion patterns in other major crypto hacks.
Binance: Acknowledges the incident as a “serious and highly sophisticated security incident,” has replenished 98% of affected assets, and is working with law enforcement. Traces the attack campaign back to June.
US Federal Bureau of Investigation (FBI): Attributes the hack to North Korea's TraderTraitor group.
Kim Yo Jong (North Korean official): Dismisses the accusations as a “sinister attempt” by the US to damage North Korea's public image.
What to Watch
Whether Binance or law enforcement can trace and freeze a significant portion of the stolen $6.3 billion in crypto assets.
Potential regulatory responses from US federal agencies, with the Fed and OCC already checking US banks' exposure following the hack.
Whether SEAL's findings prompt other exchanges to review their own security for similar long-term undetected intrusions.
12 claims in this story checked against 1 source: 11 supported.
Show each claim
SupportedThe headline says fake job interviews and a compromised internal AI tool were used in the $6.3bn Binance hack.BBC News: “Hackers who stole a record $6.3bn (£4.7bn) from Binance used fake job interviews and a compromised internal AI tool, the firm has revealed.”
SupportedBinance says the FBI’s latest information indicates North Korea was responsible for the hack.BBC News: ““The latest information released by the Federal Bureau of Investigation indicates that the Democratic People's Republic of Korea is responsible for this incident.””
SupportedPyongyang denies involvement in the hack.BBC News: “Pyongyang hit back at the claims on Tuesday, denying it was behind the hack.”
SupportedBinance apologised for the concern, disruption and uncertainty caused by the incident.BBC News: ““We apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” it said.”
SupportedBinance said 98% of the affected token assets had been replenished as of Saturday.BBC News: “It said it had also set aside more than 100% of the funds needed to cover the loss, noting 98% of the token assets impacted had been “replenished” as of Saturday.”
SupportedAn engineer was contacted through a legitimate job-hunting platform and invited to bogus interviews with fake company representatives.BBC News: “Binance said as part of the hack, one of its engineers was contacted through a legitimate job-hunting platform and invited to bogus job interviews with fake company representatives.”
SupportedDuring a second interview, the engineer was told to download malware disguised as an assignment, which evaded detection using obfuscation techniques.BBC News: “The engineer in question was instructed to download malware masquerading as an “assignment” during a second interview, that deployed malicious code with “obfuscation techniques” evading detection.”
SupportedHackers used the engineer’s compromised computer and a compromised internal AI tool to gain control of two other engineers’ laptops.BBC News: “Binance said hackers then leveraged the engineer's compromised computer and a compromised internal AI tool in October to gain control over two other engineers' laptops, and execute the next steps of the attack.”
SupportedThe incident is thought to be the largest crypto hack to date.BBC News: “The record $6.3bn (£4.7bn) attack is thought to be the largest crypto hack to date.”
SupportedBinance suspended customer withdrawals globally until service was restored on Sunday.BBC News: “The incident led Binance to suspend withdrawals for customers globally, meaning users could not get their cryptocurrency out of the platform until the service was restored on Sunday.”
SupportedUS crime agencies and cyber analysts said the hack bore signs of being orchestrated by North Korea.BBC News: “The agencies, along with a range of cyber analysts, said that the hack - like similar breaches before it - bore the signs of having been orchestrated by North Korea.”
Partly supportedBinance had previously not responded to queries about North Korea’s alleged involvement.BBC News: “Binance had previously not responded to the BBC's queries about North Korea's alleged involvement in the hack.”
