TraderTraitor Had About Eight Weeks Inside Binance Before $6.3B Hack, SEAL Estimates

TL;DR

• Security Alliance estimates North Korea-linked TraderTraitor accessed Binance’s systems for about eight weeks before the October 29 hack, which Binance valued at $6.3 billion.
• SEAL says the campaign pattern fits TraderTraitor’s selective recruitment, deep reconnaissance, front-company deception and long-running infrastructure intrusions more closely than Contagious Interview activity.
• The organization recommends stronger monitoring of lateral movement, privileged sessions, infrastructure integrity, external code execution and recruitment approaches during extended attacker dwell periods.

Security Alliance (SEAL) estimates that North Korea-linked TraderTraitor accessed Binance’s environment for about eight weeks before the exchange’s October 29 hack, valued by Binance at $6.3 billion. In a threat analysis, SEAL placed initial access around September and described the group as capable of moving quietly through endpoints and infrastructure for weeks. The eight-week dwell window suggests the attackers had substantial time inside Binance before the theft was executed. The assessment adds context to the breach at Binance, while stopping short of identifying an exact intrusion date.

TraderTraitor’s Long Dwell Time Becomes the Security Focus

SEAL said Binance’s initial findings point to a developer device compromised through malware delivered during a fake job-interview process. The security group argues the pattern better matches TraderTraitor than Contagious Interview, another North Korea-linked cluster using recruitment lures. TraderTraitor is characterized by selective targeting, deep reconnaissance and customized attack paths rather than broad malware distribution. SEAL said one observed campaign builds convincing front companies, employs legitimate third-party recruiters and takes targets through multi-stage interviews before delivering malicious code. SEAL listed CitaLab, BitFit and Oddium-related domains among front companies observed during 2026.

SEAL compares Binance with other incidents associated with TraderTraitor. SEAL estimated dwell times of about six weeks at LayerZero, three weeks at AFX and at least 24 days inside Bitget before the September 24 theft. Across those cases, the attackers allegedly used prolonged access to reach infrastructure capable of authorizing or influencing high-value transactions. In Bitget’s case, SEAL said operators moved laterally toward the wallet backend and injected fraudulent withdrawal commands without stealing private keys. The earlier LayerZero incident likewise involved infrastructure manipulation, reinforcing SEAL’s warning that defenders should monitor more than employee endpoints.

SEAL recommends treating the extended dwell period as a detection opportunity. Its guidance calls for active monitoring of cloud and endpoint logs, alerts for lateral movement and privilege escalation, short-lived sessions, device-bound tokens, integrity monitoring for binaries and isolated environments for external code. The central defensive lesson is to assume a compromised engineer can become a pathway into critical infrastructure and design controls around that possibility. SEAL also urges independent verification of unsolicited recruitment approaches and stronger monitoring of privileged third-party security products. The findings broaden the security discussion after the FBI attribution of the Binance theft to TraderTraitor and earlier North Korean recruitment campaigns targeting blockchain developers.