Security Alliance reveals TraderTraitor accessed Binance networks 2 months prior to $6.3B breach

Security Alliance reveals TraderTraitor accessed Binance networks 2 months prior to $6.3B breach

The Security Alliance reports that TraderTraitor, a hacking collective with ties to North Korea, potentially infiltrated Binance's infrastructure approximately 8 weeks before executing the historic Oct. 29 security breach.

According to a Thursday report from the Security Alliance (SEAL), a non-profit cybersecurity firm, the North Korea-associated hacking collective TraderTraitor likely penetrated Binance's network infrastructure roughly two months before carrying out the massive $6.3 billion security breach that occurred on Oct. 29.

The threat actors successfully infiltrated Binance's internal systems at some point during September, SEAL noted in their Thursday analysis, further explaining that such malicious entities possess the capability to move through compromised networks with remarkable stealth capabilities across extended time frames following their initial unauthorized entry.

Through their investigation, SEAL uncovered a minimum of four shell companies connected to TraderTraitor's fraudulent hiring operations throughout 2026, which include the domains citalab.net, citalab.com, bitfit.io and oddium.io.

The security firm's research highlighted comparable patterns of multi-phase infiltration strategies across several other notable cryptocurrency security incidents. Their assessment suggested that malicious actors maintained approximately six weeks of system access prior to the $388 million Bitget security breach, had roughly six weeks of penetration into LayerZero systems before exploiting the security weakness that resulted in the $293 million Kelp DAO incident, and operated within compromised systems for around three weeks before executing the $24 million AFX security exploit.

Binance was approached by Cointelegraph for commentary regarding these timeline estimates, however no reply was received prior to this article's publication. The exchange has publicly stated that the $6.3 billion cyber attack resulted from a fraudulent employment interview scheme that allowed the attackers to gain control of an employee's device and extract login credentials, ultimately providing unauthorized access to the platform's wallet systems.

According to Binance's internal investigation, the attack operation can be traced back to June, when another staff member's device was initially compromised. While the exchange successfully identified this intrusion and replaced the affected device, Binance acknowledged that the perpetrators had already collected critical intelligence regarding its personnel structure and wallet architecture, as detailed in a Tuesday post on the X platform.

The United States Federal Bureau of Investigation officially linked the cyber attack to TraderTraitor, a North Korean threat actor group, in a report released on Saturday. Kim Yo Jong, the sibling of North Korean supreme leader Kim Jong Un, rejected these allegations.