This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
TraderTraitor, North Korea-linked, accessed Binance internal systems about eight weeks before the October hack. SEAL estimates a multi-stage intrusion pattern with weeks-long access.
Eight Weeks Inside Binance
Security Alliance (SEAL) estimated that the North Korea-linked TraderTraitor gained access to Binance’s internal systems about eight weeks before the $6.3 billion Binance hack. SEAL wrote that TraderTraitor likely first breached Binance’s systems in September, then carried out the large-scale theft of funds on the 29th of last month.
Binance said the latest hack began with fake job interviews that infected employee devices, leading to stolen credentials and a breach of the exchange’s wallet infrastructure. SEAL also identified at least four front companies tied to TraderTraitor’s 2026 fake recruiting campaigns, including citalab.net, citalab.com, bitfit.io, and oddium.io.
Competing attributions
The Federal Bureau of Investigation attributed the attack to North Korea’s TraderTraitor, while Kim Yo Jong denied the allegation. Cointelegraph reported that Binance traced the attack campaign back to June, when a separate employee’s device was compromised and Binance detected the incident and replaced the device.
SEAL said threat actors can maintain a “high degree of stealth over prolonged periods of time” after initial intrusion, while it flagged a recurring multi-stage intrusion pattern behind other major crypto heists. SEAL estimated lead times of about six weeks before the $388 million Bitget hack and about six weeks before the $293 million Kelp DAO exploit tied to a LayerZero vulnerability.
Security response pressure
SEAL said threat actors can explore systems for a considerable period after initial infiltration, and it described the Binance breach as part of a multi-stage infiltration pattern seen in other major cryptocurrency hacks. BigGo Finance said SEAL’s analysis adds pressure on cryptocurrency exchanges' overall security response systems, with critics calling for multi-layered defenses covering intrusion detection, credential management, and procedures for retrieving devices from departing or reassigned employees.
Binance’s account tied the compromise to fake job interviews and the resulting infection of an employee device, while SEAL’s analysis pointed to social engineering through hiring rather than a single vulnerability. Cointelegraph said it contacted Binance for comment on SEAL’s estimates but did not receive a response by publication, leaving the timing and method claims contested across the reporting.
