Nonprofit cybersecurity organization Security Alliance (SEAL) estimated that North Korea-linked hackers compromised a Binance employee’s device about eight weeks before the exchange’s $6.3 billion exploit on Oct. 29, 2026. Binance distinguished that intrusion window from the broader attack campaign, which it said began in June, and said attackers did not obtain access needed to reach wallet operations until Oct. 20.
The distinction was included in a correction to Cointelegraph’s report, updated on Nov. 6 at 5:03 p.m. UTC.
How the intrusion developed
According to Binance’s account, the campaign involved several stages:
- June: An employee’s device was compromised after they downloaded a tampered Homebrew installation while trying to install an AI coding tool. Binance said it detected the incident, replaced the device and rotated related credentials. However, attackers had already obtained information about employees working on its wallet infrastructure.
- September: A software engineer’s device was compromised through a fake recruitment scheme, according to SEAL’s Thursday report. SEAL’s roughly eight-week estimate concerned the September-to-October intrusion window, not the start of the broader campaign.
- Oct. 20: Binance said attackers used the compromised engineer’s computer and an internal AI tool to gain control of two wallet infrastructure engineers’ devices. They subsequently discovered a deployment permission token.
- Oct. 29: That token was used in the $6.3 billion exploit, according to Binance.
A Binance spokesperson told Cointelegraph that the initial device compromises occurred in June and September, but that the attackers gained the access needed to reach wallet operations only on Oct. 20, when they moved laterally to additional devices and credentials.
SEAL points to prolonged, stealthy access
SEAL said attackers can navigate compromised systems with a “high degree of stealth over prolonged periods of time” after an initial intrusion. It identified at least four front companies associated with TraderTraitor’s fake recruitment campaigns in 2026: citalab.net, citalab.com, bitfit.io and oddium.io.
The organization also cited similar multistage intrusion patterns in other crypto attacks. It estimated that attackers had about six weeks of access before the $388 million Bitget hack, six weeks of access to LayerZero before the vulnerability that led to the $293 million Kelp DAO exploit, and about three weeks before the $24 million AFX exploit.
The US Federal Bureau of Investigation attributed the Binance attack to North Korea’s TraderTraitor in a Saturday report. Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations.
Original publication: Nov. 6, 2026, at 19:26:30 UTC+8. The supplied article carries a later correction timestamp of Nov. 6 at 17:03 UTC.