North Korea-Linked TraderTraitor Breached Binance Systems 8 Weeks Before $6.3 Billion Hack

• North Korea-linked TraderTraitor is believed to have had access to Binance’s internal systems for about eight weeks before the $6.3 billion Binance hack.
• SEAL said it found a recurring multi-stage intrusion pattern in major crypto hacks, with attackers maintaining access for several weeks before the theft.
• Binance said employee devices were infected through fake job interviews, leading to stolen credentials and a breach of the exchange’s wallet infrastructure.

Forecast Trend Report by Period

North Korea-linked hacking group TraderTraitor is believed to have gained access to Binance’s internal systems roughly eight weeks before the $6.3 billion hack.

Cointelegraph reported on Nov. 6 that the Security Alliance, or SEAL, a nonprofit cybersecurity group, said in a report that TraderTraitor likely first breached Binance’s systems in September, about eight weeks before the Oct. 29 hack. After an initial breach, threat actors can spend long periods exploring systems while maintaining a high degree of stealth, the report said.

SEAL said it identified at least four front companies used by TraderTraitor in 2026 for fake recruiting campaigns.

SEAL also found similar multi-stage intrusion patterns in other major crypto hacks. It estimated a lead time of about six weeks in the $388 million Bitget hack, about six weeks in the $293 million KelpDAO hack tied to a LayerZero vulnerability, and about three weeks in the $24 million AFX hack.

Binance said the latest hack began with fake job interviews that infected employee devices, leading to stolen credentials and a breach of the exchange’s wallet infrastructure. The campaign began in June, when another employee device was infected, though Binance detected the compromise and replaced the device. By then, however, the attackers had already gathered information on internal team structures and wallet infrastructure.

Meanwhile, the Federal Bureau of Investigation attributed the attack to North Korea’s TraderTraitor. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied the allegation.

Minseung Kang