A North Korea-linked hacking group is believed to have had access to Binance's internal systems eight weeks before the $6.3 billion Binance hack took place. CoinTelegraph reported on the 6th that the nonprofit cybersecurity group Security Alliance (SEAL) made this analysis in a report released on the 5th (local time).
According to the report, the group known as TraderTraitor first breached Binance's systems in September, then carried out the large-scale theft of funds on the 29th of last month. SEAL explained that threat actors can maintain a high level of stealth and explore systems for a considerable period after initial infiltration. The group identified at least four front companies mobilized in the 2026 fake recruiting campaign: citalab.net, citalab.com, bitfit.io, and oddium.io.
The incident follows the same multi-stage infiltration pattern seen in other major cryptocurrency hacks. SEAL's estimated pre-access periods are as follows.
Note: Pre-access periods are estimates by Security Alliance.
Binance described a fake job interview as the starting point of the breach. An employee's device was infected with malware, credentials were stolen, and this in turn allowed the exchange's wallet infrastructure to be compromised. The attack campaign dates back to June. At that time, another employee's device was infected, and Binance detected it and replaced the device, but the attackers had already obtained information on internal team composition and wallet infrastructure.
The U.S. Federal Bureau of Investigation (FBI) attributed the attack to North Korea's TraderTraitor. However, Kim Yo-jong, the sister of North Korean leader Kim Jong-un, denied the claim.
The analysis adds pressure on cryptocurrency exchanges' overall security response systems. Critics say multi-layered defenses are needed—covering intrusion detection, credential management, and procedures for retrieving devices from departing or reassigned employees—given that attackers secured internal access through social engineering via the hiring process rather than a single vulnerability, then operated covertly over several weeks. As the wallet infrastructure of a major exchange was targeted, the fallout for user asset protection and exchange credibility is also expected to be significant.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
