Binance Breach: Hackers Reportedly Sat Inside for 8 Weeks Before the Heist
Security Alliance estimates North Korea-linked hackers had roughly eight weeks of access to Binance before the $6.3B theft. Here is what it means for traders.
In this article
The non-profit group Security Alliance (SEAL) estimates that attackers were inside Binance's systems for about eight weeks before the $6.3 billion theft on 29 October. For traders, the finding suggests that big exchange hacks may be prepared quietly over a long period, which makes counterparty risk on any platform a live question.
Key takeaways
- Long dwell time: SEAL believes the North Korea-linked group TraderTraitor got into Binance's systems in September, about eight weeks before the exploit.
- A repeating pattern: SEAL says other major heists, including the $388 million Bitget hack, followed a similar multi-stage intrusion.
- Entry point: Binance has said the breach began with a fake job interview that compromised an employee device.
- Market impact: BNB is slightly higher today, while the broader majors are mixed.
What SEAL found
In a report published on Thursday, SEAL said the attackers can move through compromised systems with a high degree of stealth for long periods after the first intrusion. That would mean the public theft was the final step of a campaign that started well before. Cointelegraph said it asked Binance for comment on the estimates but had received no reply when it published.
SEAL also compared the Binance case with other incidents. It estimated about six weeks of access before the $388 million Bitget hack and about six weeks of access to LayerZero before the vulnerability behind the Kelp DAO exploit. It put the lead time for the AFX exploit at about three weeks. These are SEAL's estimates, not confirmed facts from the affected companies.
How the breach happened
Binance has attributed the incident to a fake job interview. According to its account, the interview let hackers compromise an employee device and steal credentials, which gave them a route into the exchange's wallet infrastructure. Reports also say the attack itself took only about 20 minutes, so the weeks of quiet preparation before it are the part SEAL is highlighting.
The lesson SEAL draws is that a single compromised engineer can become a path into critical systems. It urges people to verify unsolicited recruitment approaches independently and to monitor third-party security tools more closely. Reports also note that North Korea has denied involvement in the theft.
Market snapshot
Prices at 17:07 UTC on 6 November show a mixed picture, with no obvious panic in the largest assets.
| Asset | Price | Change today |
|---|---|---|
| BNB | 696.44 | +0.71% |
| BTC | 75,871.00 | -0.34% |
| ETH | 2,230.13 | -1.16% |
| XRP | 1.1900 | -3.82% |
BNB has traded between 683.73 and 698.03 today, so it sits near the top of its daily range. Today's moves cannot be tied directly to the SEAL report, since many factors drive crypto prices.
What to watch next
- Any response from Binance to SEAL's estimates, and the results of the independent security review it has reportedly commissioned.
- Whether other exchanges and protocols disclose changes to hiring checks, device security and wallet controls.
- Further analysis of how the stolen funds are moved or laundered.
Traders may also want to review how much they keep on exchanges and whether they use self-custody or other safeguards for longer-term holdings.
Crypto markets are highly volatile and this article is for education only, not investment advice.
Frequently asked questions
Who does Security Alliance say was behind the Binance hack?
SEAL points to TraderTraitor, a North Korea-linked threat group. Reports note that North Korea has denied being behind the theft.
How long were the attackers inside Binance before the exploit?
SEAL estimates about eight weeks, with initial access around September and the theft on 29 October.
How did the attackers get in, according to Binance?
Binance says a fake job interview led to a compromised employee device and stolen credentials, which opened a path to its wallet infrastructure.