North Korea-Linked TraderTraitor Breached Binance Systems 8 Weeks Before $6.3 Billion Hack
Summary
- The North Korea-linked group TraderTraitor said it had access to Binance's internal systems about eight weeks before the $6.3 billion Binance hack.
- SEAL said it found a multistage intrusion pattern in other major crypto hacks, with advance access lasting several weeks.
- Binance said fake job interviews infected employee devices, leading to stolen credentials and a breach of the exchange's wallet infrastructure.
Forecast Trend Report by Period
A North Korea-linked hacking group known as TraderTraitor is believed to have accessed Binance's internal systems about eight weeks before the $6.3 billion hack.
Cointelegraph reported on November 6 that the Security Alliance, a nonprofit cybersecurity group known as SEAL, said in a report that TraderTraitor is believed to have first infiltrated Binance's systems in September, about eight weeks before the October 29 hack. The group added that threat actors can explore systems over an extended period while maintaining a high degree of stealth after an initial breach.
SEAL also identified at least four front companies that TraderTraitor used in 2026 for fake recruitment campaigns.
The group said it found a similar pattern of multistage intrusions in other major crypto hacks. It estimated a lead time of about six weeks in the $388 million Bitget hack, about six weeks in the $293 million KelpDAO hack tied to a LayerZero vulnerability, and about three weeks in the $24 million AFX hack.
Binance said the latest hack stemmed from fake job interviews that infected employee devices, allowing attackers to steal credentials and compromise the exchange's wallet infrastructure. The campaign began in June, when a separate employee's device was infected, though Binance detected the breach at the time and replaced the device. By then, however, the attackers had already collected information on internal team structures and wallet infrastructure.
Separately, the Federal Bureau of Investigation attributed the attack to North Korea's TraderTraitor. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied the allegation.
