TraderTraitor's Stealthy Breach of Binance: Weeks of Access Preceded $6.3 Billion Hack

The hackers initially infiltrated Binance’s infrastructure sometime in September. According to SEAL’s report released on Thursday, the attackers maintained a high level of stealth within these systems, enabling them to move undetected for extended periods following their first entry.

SEAL uncovered at least four shell companies linked to TraderTraitor’s fraudulent recruitment campaigns planned for 2026. These entities include citalab.net, citalab.com, bitfit.io, and oddium.io.

Further analysis by SEAL revealed this attack followed a multi-layered intrusion pattern similar to those found in other significant cryptocurrency breaches. Specifically, attackers had around six weeks of access prior to the $388 million Bitget hack, six weeks on LayerZero before the vulnerability led to the $293 million Kelp DAO exploit, and roughly three weeks before the $24 million AFX attack.

Cointelegraph reached out to Binance for comment regarding SEAL’s estimates but received no reply before publication. Binance attributes the $6.3 billion breach to a fraudulent job interview scheme that compromised an employee’s device, granting hackers credentials to penetrate the exchange’s wallet infrastructure.

Binance traced the intrusion back to June when another employee’s device was first compromised. Although the exchange detected this earlier breach and replaced the affected device, by then the attackers had already gathered sensitive data concerning Binance’s team and wallet systems, as stated in a Tuesday post on X.

The U.S. Federal Bureau of Investigation linked the attack to the North Korean hacking group TraderTraitor in a report issued on Saturday. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied the allegations.

This detailed timeline and pattern of stealthy access reveal the sophisticated nature of TraderTraitor’s operations, emphasizing the persistent risks posed by state-linked cyber threat groups to major cryptocurrency platforms.