For holders assessing exchange custody, the Binance incident highlights an important distinction: compromising an employee’s device is not necessarily the same as gaining access to wallet operations. In reporting published on Nov. 6, 2026, Security Alliance (SEAL) estimated an intrusion window of about eight weeks before the Oct. 29, $6.3 billion exploit. Binance said the access needed to reach wallet operations came later, on Oct. 20.
What the eight-week estimate means
According to the nonprofit cybersecurity organization’s Thursday report, North Korea-linked hackers compromised a Binance software engineer’s device in September through a fake recruitment scheme. SEAL’s estimate concerns that September-to-October intrusion window—not the start of the broader campaign, which Binance traced to June.
SEAL warned that attackers can navigate compromised systems with a “high degree of stealth over prolonged periods of time” after an initial intrusion.
A Binance spokesperson told Cointelegraph that initial device compromises occurred in June and September, but attackers did not obtain the access needed to reach wallet operations until Oct. 20. At that point, the spokesperson said, they used their foothold to move laterally and access additional devices and credentials.
The reported path to wallet infrastructure
Binance described the following sequence:
- June: A separate employee downloaded a tampered Homebrew installation while trying to install an AI coding tool. Binance said it detected the compromise, replaced the device and rotated related credentials. However, attackers had already obtained information about employees working on its wallet infrastructure, according to the exchange’s Tuesday post on X.
- September: A software engineer’s device was compromised through the fake recruitment scheme described by SEAL.
- Oct. 20: According to Binance, attackers used that engineer’s compromised computer and an internal AI tool to take control of two wallet infrastructure engineers’ devices.
- Before the Oct. 29 exploit: The attackers discovered a deployment permission token, which they subsequently used in the exploit.
The distinction matters when interpreting the incident: SEAL’s estimated intrusion window and Binance’s account of later wallet-related access describe different stages of the attack, rather than a single period of uninterrupted wallet access.
Attribution and other reported intrusion windows
SEAL identified at least four “front companies” associated with TraderTraitor’s fake recruitment campaigns in 2026: citalab.net, citalab.com, bitfit.io and oddium.io.
The organization also described similar multistage patterns in other crypto incidents. It estimated approximately six weeks of attacker access before the $388 million Bitget hack, six weeks of access to LayerZero before the vulnerability that led to the $293 million Kelp DAO exploit, and about three weeks before the $24 million AFX exploit. These access durations are SEAL’s estimates.
The US Federal Bureau of Investigation attributed the Binance attack to North Korea’s TraderTraitor in a Saturday report. Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations.
For long-term holders, the custody issue illustrated by this account is the chain of access behind wallet operations: employee devices, credentials and deployment permissions. Binance’s reported response to the June compromise did not, according to its account, prevent the later stages of the campaign.
Source and historical context: Original Cointelegraph article, published Nov. 6, 2026, at 19:26:30 UTC+08:00. The supplied article carries a correction dated Nov. 6 at 17:03 UTC clarifying the timeline and adding Binance’s statement. This summary reflects that corrected account.