Binance hackers had 8 weeks of access before $6.3B exploit, Security Alliance estimates

Latest NewsPublishedNov 6, 2026The cybersecurity company flagged similar multi-stage intrusion patterns behind other high-profile crypto heists, including the $388 million Bitget hack.Non-profit cybersecurity organization Security Alliance (SEAL) estimates that the North Korea-linked TraderTraitor gained access to Binance’s systems about eight weeks before the $6.3 billion exploit on Oct. 29.The hacking group gained access to Binance’s systems sometime in September, wrote SEAL in a Thursday report, adding that threat actors can navigate these systems with a “high degree of stealth over prolonged periods of time” after initial intrusion. SEAL identified at least four “front companies” associated with TraderTraitor’s fake recruitment campaigns in 2026, including citalab.net, citalab.com, bitfit.io and oddium.io. The cybersecurity organization’s analysis pointed to similar multi-stage intrusion patterns in other high-profile crypto hacks. It estimated that attackers had about six weeks of access before the $388 million Bitget hack, six weeks of access to LayerZero before the vulnerability that led to the $293 million Kelp DAO exploit and about three weeks before conducting the $24 mil...