SEAL Says Binance Attackers Had Weeks to Move Through Internal Systems
How the intrusion unfolded
The Binance exploit shows how a long intrusion can precede the moment attackers reach systems capable of moving funds. Security Alliance (SEAL) estimates hackers had access to an employee’s device for about eight weeks before the Oct. 29 incident, while Binance says the broader campaign began months earlier and access to wallet operations came later. Those accounts describe different points in the same sequence: an initial foothold, further movement through company systems, and eventual access to infrastructure tied to wallet operations.
That distinction matters because an initial device compromise doesn’t automatically give an attacker the ability to move funds. In a large organization, access is often divided across devices, credentials and internal tools. An intruder may first need to learn who works on sensitive systems and how those systems connect. The account Binance gave suggests that the time between compromise and operational access was part of the attack itself, not merely a delay before it.
Two timelines describe different stages
In a Thursday report, SEAL said the North Korea-linked group compromised a Binance software engineer’s device in September through a fake recruitment scheme. Its eight-week estimate refers to the September-to-October intrusion period. SEAL warned that attackers can move through compromised systems with a “high degree of stealth over prolonged periods of time.” The estimate therefore describes the suspected duration of access associated with that September compromise, rather than the full span of the campaign Binance later outlined.
Binance told Cointelegraph that the campaign’s initial device compromises took place in June and September. The exchange says attackers didn’t gain access to wallet operations until Oct. 20, when they used an existing foothold to move laterally into other devices and credentials. That account separates the first signs of compromise from the point at which the attackers could reach the systems relevant to the eventual exploit.
“As outlined in our announcement, the initial device compromises occurred in June and September, but the attackers did not gain the access needed to reach wallet operations until October 20, when they used that foothold to move laterally and obtain access to additional devices and credentials,” a Binance spokesperson said.
The distinction matters: SEAL’s estimate concerns the suspected access window tied to the September compromise, while Binance’s account separates that foothold from the later access to wallet infrastructure. Binance valued the Oct. 29 exploit at $6.3 billion. That figure describes the stated value of the exploit, but it doesn’t by itself explain how the attackers moved from a compromised employee device to wallet operations.
Recruitment lures and an internal tool
SEAL linked at least four “front companies” to TraderTraitor’s fake recruitment campaigns in 2026: citalab.net, citalab.com, bitfit.io and oddium.io. The sites’ names are useful indicators of the campaign described by SEAL, but the central tactic was the recruitment approach itself. A job related interaction can give an attacker a reason to send files or direct a target toward software that appears relevant to their work.
Binance traced the campaign’s first known compromise to June. An employee downloaded a tampered Homebrew installation while trying to install an AI coding tool. Binance detected the incident, replaced the device and rotated related credentials. But the attackers had already gathered information about employees working on wallet infrastructure, the exchange said in a Tuesday X post.
That sequence illustrates why replacing a device and changing credentials may not close every path an intruder has already opened. Information gathered before detection can help identify other targets inside the organization. If you’re working in this space, the episode is a reminder that employee devices and internal knowledge can form part of the same attack path. The harder question is whether the response also accounts for what attackers learned while they had access.
On Oct. 20, Binance said, attackers used the September-targeted engineer’s computer and an internal AI tool to take control of devices belonging to two wallet infrastructure engineers. They then found a deployment permission token that was used in the Oct. 29 exploit. The reported chain links a compromised device to additional employee devices, then to a permission that could be used in deployment. Several steps, each dependent on access gained earlier.
Similar patterns at other crypto firms
SEAL’s analysis describes multi-stage intrusions across several major crypto incidents. It estimates attackers had roughly six weeks of access before the $388 million Bitget hack, six weeks of access to LayerZero before the $293 million Kelp DAO exploit, and about three weeks before the $24 million AFX exploit. The estimates don’t establish that every incident followed the same route. They do suggest that, in these cases, the visible loss came after attackers had time to operate within or around their targets.
The US Federal Bureau of Investigation attributed the Binance attack to North Korea’s TraderTraitor in a Saturday report. Kim Yo Jong, sister of North Korean leader Kim Jong Un, rejected the accusation. The attribution and denial are part of the public record described here; neither changes the operational account of how Binance says the attackers reached wallet infrastructure.
What the access window means for security teams
The reported access windows point to a practical security challenge for crypto firms: detecting an initial compromise is only part of the response. The path from an employee device to wallet operations can leave attackers time to collect credentials and map internal access. The Binance account also shows why the first affected device may not be the only relevant one by the time an incident is discovered.
This is more significant than it looks. A security team can respond quickly to a known compromised laptop and still face questions about credentials, permissions and other devices touched along the way. Similar intrusions often turn on how far attackers can travel after the first entry, so reviewing connected access paths matters alongside isolating the original device. And this is the part most people overlook: a foothold can be valuable even before it grants direct access to funds.
For readers assessing the incident, the available accounts leave a distinction between the time attackers may have had access and the time they could reach wallet operations. That gap helps explain why a campaign can begin well before a reported exploit. It also points to a difficult defensive task: recognizing when routine access has become a route toward more sensitive systems. The warning is plain. Persistent access can precede the most visible damage.
Related coverage, but not a measure of the security issues described above.
Related: Binance hack may be ‘temporary setback’ for crypto, Grayscale’s Pandl says
Updated (Nov. 6 at 05:03 p.m. UTC): This article was corrected to clarify the timeline of the Binance hack and added a statement from a Binance spokesperson.
Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.
All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.
