The cybersecurity company flagged similar multi-stage intrusion patterns behind other high-profile crypto heists, including the $388 million Bitget hack.
Non-profit cybersecurity organization Security Alliance (SEAL) estimates that the North Korea-linked TraderTraitor gained access to Binanceās systems about eight weeks before the $6.3 billion exploit on Oct. 29.
The hacking group gained access to Binanceās systems sometime in September, wrote SEAL in a Thursday report, adding that threat actors can navigate these systems with a āhigh degree of stealth over prolonged periods of timeā after initial intrusion.
SEAL identified at least four āfront companiesā associated with TraderTraitorās fake recruitment campaigns in 2026, including citalab.net, citalab.com, bitfit.io and oddium.io.
The cybersecurity organizationās analysis pointed to similar multi-stage intrusion patterns in other high-profile crypto hacks. It estimated that attackers had about six weeks of access before the $388 million Bitget hack, six weeks of access to LayerZero before the vulnerability that led to the $293 million Kelp DAO exploit and about three weeks before conducting the $24 million AFX exploit.
Cointelegraph contacted Binance for comment on the estimates but did not receive a response by publication. Binance attributed the $6.3 billion hack to a fake job interview that enabled hackers to compromise an employee device and steal credentials to breach the exchangeās wallet infrastructure.
Binance traced the attack campaign back to June, when a separate employeeās device was compromised. The exchange detected the incident and replaced the device, but said that attackers had already gathered information about its team and wallet infrastructure, according to a Tuesday X post.
The US Federal Bureau of Investigation attributed the attack to North Koreaās TraderTraitor, in a Saturday report. Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations.
Related: Binance hack may be ātemporary setbackā for crypto, Grayscaleās Pandl says
