Binance Hackers Were Inside for Eight Weeks Before the $6.3 Billion Theft, Security Alliance Estimates

Published November 6, 2026, 5:40 PM PKT. Based on the Security Alliance report "TraderTraitor vs Contagious Interview", published November 5, 2026 (primary source), with additional reporting by Cointelegraph on November 6, 2026 (secondary reporting), plus Binance's Initial Findings and Response update, published November 3, 2026 (primary prior position on how the attack began).

North Korea-linked hackers were inside Binance's systems for about eight weeks before they stole about $6.3 billion in cryptocurrency on October 29, 2026, according to an estimate published by the nonprofit cybersecurity organization Security Alliance, known as SEAL. The group, which SEAL and the U.S. Federal Bureau of Investigation identify as TraderTraitor, gained access sometime in September, SEAL wrote in a report published on Thursday, November 5, and then moved through the exchange's systems with what SEAL called a high degree of stealth over prolonged periods of time before striking. The eight-week figure is an estimate, not a confirmed log entry, and it reframes the largest crypto theft on record from a single breach into a two-month intrusion that went undetected until the money moved. SEAL's report describes the theft itself as approximately $6.4 billion, slightly above the about $6.3 billion figure Binance has used.

The September entry: eight weeks of stealth

The dwell time is the core of SEAL's finding. Once TraderTraitor gets a foothold, the report says, its operators navigate endpoints and systems with a high degree of stealth over prolonged periods, and in every case SEAL examined, the intrusion was there to be found if defenders had been looking for it. For Binance, SEAL puts the window at about eight weeks, from September to October 29. That sits alongside Binance's own account, published November 3, which traces the campaign back further, to June, when a separate employee's device was compromised. Binance said it detected that June incident and replaced the device, but the attackers had already gathered information about its team and wallet infrastructure. The two accounts describe different stages of the same campaign: an early device compromise in June, then systems access from September, then the drain on October 29. The FBI attributed the attack to North Korea's TraderTraitor in a report on Saturday, October 31, and Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations, according to Cointelegraph.

The four front companies

SEAL names four fictitious companies TraderTraitor used in fake recruitment campaigns during 2026: citalab.net, citalab.com, bitfit.io and oddium.io. The report says this cluster of activity builds out highly legitimate appearing companies, complete with an operational front end, corporate registration data and an active online presence with no reports of malicious behavior, so the deception survives basic due diligence and multiple rounds of interviews. The operators also hire legitimate third-party recruiters who appear at various stages of the hiring process, and SEAL notes these are real people who get on real phone calls and may even run outreach for the front companies in good faith. Binance's own report matches the pattern: the exchange said one targeted engineer, identified as Engineer B, went through two rounds of interviews, each with different people, before a codebase was delivered during the process. In the July 2026 intrusion into AFX, SEAL says, the attackers used a self-hosted GitLab instance at git.oddium.io, with commands built to look like a company's custom internal tooling. Cloning the weaponized repository can exploit CVE-2025-48384, a flaw that enables arbitrary file writes and ultimately code execution on Linux and macOS when using git clone with the recursive flag, and SEAL warns that even experienced engineers have been caught off guard because simply cloning a repository is generally perceived to be low risk.

Three clusters, one group: LayerZero, AFX and Bitget

SEAL says it observed three distinct activity clusters linked to TraderTraitor over the past year, all connected by shared indicators and onchain activity, and the dwell times form a pattern. The first cluster used malicious HashiCorp Terraform providers, observed during the LayerZero hack in April 2026, where SEAL puts the intrusion at about six weeks, from March 6 to April 18, before the vulnerability that led to the $293 million Kelp DAO exploit. The lure there was a malicious code assessment task delivered through a trojanized Terraform registry, leading to cross-platform backdoors, and the campaign targeted backend, cloud infrastructure and DevOps engineers specifically because their access can open a path into valuable infrastructure. The second cluster is the front companies and GitLab repositories described above, used against AFX in July 2026, where SEAL puts the intrusion at about three weeks, from July 9 to July 22, before a $24 million exploit. The third cluster needed no recruiter at all: Bitget says a zero-day vulnerability in third-party security products, referred to only as Product A and Product B, was used to obtain privileges inside an internal management platform. The earliest malicious activity in the available logs dates back to August, the theft took place on September 24, and SEAL puts the dwell at about six weeks before the $388 million hack. During that period the operators obtained valid administrative credentials, moved laterally toward the wallet backend and injected fraudulent withdrawal commands directly into the compromised infrastructure using a custom tool. No private key was stolen in the Bitget case, SEAL says, and the legitimate signing system was abused to process transactions that otherwise should not have been processed. SEAL notes it is still awaiting Bitget's final post-mortem report.

TraderTraitor is not Contagious Interview

A central point of the report is that Binance's attackers should not be confused with Contagious Interview, a separate North Korean subgroup that also uses job interviews to drop malware. Contagious Interview is generally much more scatter-shot, SEAL says, distributing relatively generic malicious repositories across a broad population of developers. TraderTraitor, also known as Jade Sleet and UNC4899, is different: careful target selection, deep research, custom attack path design and long running campaigns aimed at establishing any possible foothold, including the use of in-real-life facilitators in place of synthetic digital identities. The group is known to target multiple employees at a single company relentlessly, sending hundreds of messages on a variety of platforms to engineers, DevOps staff, site reliability engineers and anyone who might have critical access to infrastructure. SEAL warns that a company threat model tuned for Contagious Interview will fail against TraderTraitor, because the preparation, the operators and the post-exploitation are different. The report also notes that the personas and lures themselves are at times unconvincing and amateurish, while the operators conducting the intrusion demonstrate considerable technical sophistication, patience and operational discipline, so a defender who judges the threat by the quality of the recruiter persona or coding assessment may dramatically underestimate the adversary.

What SEAL says defenders should change

SEAL's advice centers on the dwell window itself, which it calls the area where the defender's advantage sits. Companies should enable and actively monitor cloud and endpoint logs, prioritizing signs of lateral movement, privilege escalation and credential abuse rather than focusing exclusively on initial access, because the initial compromise may appear clean while subsequent attacker activity leaves detectable traces. Session keys and cloud identity need the same treatment: LayerZero was a session key theft leading into a cloud environment, so SEAL recommends short-lived sessions, device-bound tokens and alerting on new sessions from unknown devices for anyone with cloud or signing-adjacent access, treating a developer's session as a privileged credential. Infrastructure integrity matters because both LayerZero and Bitget involved infrastructure-level data manipulation rather than key theft, so withdrawal instructions should be independently validated against a trusted source before signing, and binaries and configurations on verification and signing-related systems should be monitored. Any external code task, from an interview assignment to a vendor proof of concept, should run in a throwaway virtual machine with no access to corporate credentials, SSH keys or cloud sessions. Recruiter verification should be a process, not training, because the operations involve real people conducting interviews and registered companies that withstand basic due diligence: unsolicited recruitment targeting employees with privileged access should be reported to security for independent verification, including checks of company history, domain registration and the recruiter's professional identity. Finally, companies should maintain an organizational map that identifies employees with access to critical systems and the paths for lateral movement and privilege escalation, so controls can be prioritized for the people whose access could enable a compromise.

Where the Binance recovery stands

The SEAL report lands while Binance is still restoring services after the theft. The exchange said in Recovery Update #7, published November 4, that about 98% of the affected amount had been replenished, and it has been reopening withdrawals in batches, with a fourth batch under Recovery Update #9 on November 6. About $2.85 billion of the stolen funds was frozen on chain through coordination with blockchain partners, according to Binance's initial findings. The full zero knowledge proof for the expanded 44-token proof of reserves snapshot was expected to take about 50 to 60 hours from November 4, and PANews reported on November 6 that the proof was live, while Binance itself had published no announcement confirming completion at the time of writing. The full technical post-incident report is still pending, and SEAL's report notes that Binance has not yet provided any meaningful technical indicators, which is why the organization published its own threat profile from TraderTraitor activity tracked across the industry.

Sources

• Security Alliance, TraderTraitor vs Contagious Interview: A Look at Binance's Initial Incident Report, November 5, 2026 (primary source: eight-week access estimate, four front companies, three activity clusters, dwell times for LayerZero, AFX, Bitget and Binance, TraderTraitor versus Contagious Interview distinction, defence recommendations)
• Cointelegraph, Binance Hackers Had 8 Weeks of Access Before $6.3B Exploit, Security Alliance Estimates, November 6, 2026 (secondary reporting: eight-week estimate, September entry, four front companies, six-week Bitget dwell, $388 million Bitget hack, $293 million Kelp DAO exploit, $24 million AFX exploit, FBI attribution, Kim Yo Jong dismissal)
• Binance, Initial Findings and Response update, November 3, 2026 (primary prior position: fake job interview lure, June device compromise detected and replaced, September fake interview, October 20 AI tool pivot, October 29 drain, about $2.85 billion frozen, no private key leak claimed)
• Binance, Recovery Update #7, November 4, 2026, and Recovery Update #9, November 6, 2026 (primary prior position: about 98% replenished, 44-token proof of reserves snapshot, fourth withdrawal batch)

This article is news reporting and is not investment advice.