1. Binance Hack Followed Eight Weeks of Hidden Access, Security Alliance Estimates
Security Alliance, known as SEAL, a non-profit cybersecurity organization, estimates that the North Korea-linked group TraderTraitor was inside Binance's systems for about eight weeks before the $6.3 billion theft on October 29. In a report published on Thursday, November 5, SEAL places the start of that access in September and says the Binance hack fits a pattern seen in other large crypto heists.
The estimate shifts attention from the day of the theft to the weeks before it. A large exploit can look sudden from the outside, but the finding suggests that the visible moment, when funds leave, is the last step of a longer operation in which attackers explore, collect information and wait.
SEAL's work is an estimate rather than a confirmed forensic finding by the exchange, and it should be read that way. It nevertheless gives defenders a concrete number to consider when they ask how long an intruder might remain undetected.
Stealth of this kind is hard to counter because ordinary activity can mask it. A compromised account that behaves like a normal employee, logging in at expected times and opening familiar tools, does not trigger the alarms that a sudden mass transfer would. That is why security specialists stress behavioral monitoring and strict limits on privileges.
The finding also matters for how losses are discussed. A headline figure such as $6.3 billion describes the damage on the day funds were taken, but it says nothing about how long the exchange was exposed. Adding an eight-week estimate of exposure gives readers a fuller picture of the risk that large platforms carry.
2. How Long Did the Attackers Have Access?
According to the SEAL report, the group gained access at some point in September, roughly eight weeks before the October 29 exploit. The organization warns that once intruders get in, they can move through systems with a high degree of stealth over prolonged periods of time.
That warning describes a basic feature of multi-stage intrusions. The first foothold is rarely the end goal. Attackers use it to learn how the target's systems are arranged, to find the people and machines that control valuable assets and to prepare the final move so that it succeeds quickly and leaves little time to respond.
Eight weeks is long enough for a patient group to do exactly that. It also means that defensive measures aimed only at stopping a theft in progress may arrive too late, because the decisive work has already been done.
Cryptocurrency exchanges face an unusual version of this problem. The assets they guard are directly transferable and cannot be reversed once sent, so a successful attacker gains value immediately. This raises the importance of controls that stop a single compromised person or device from authorizing large movements of funds.
3. What Did Binance Say About How the Breach Began?
Binance attributes the $6.3 billion theft to a fake job interview. According to the exchange, that lure let hackers compromise an employee's device, steal credentials and then breach the wallet infrastructure of the exchange.
Binance also says the campaign began earlier than that, in June, when a different employee's device was compromised. The company detected that incident and replaced the device, but the attackers had by then gathered information about its team and its wallet systems. The exchange described this timeline in a post on X published on Tuesday.
The two accounts are different in emphasis rather than in direction. Binance describes a slow campaign that started with reconnaissance in the summer, while SEAL's estimate concerns the period of access that preceded the exploit itself. Both depict an operation built around people, not around a single technical flaw.
These factors help explain why employee-focused deception has become a favored approach. Technical defenses on a well-run exchange can be strong, whereas a person who believes they are taking part in a genuine hiring process may take actions that bypass them. Training and clear internal rules on handling outside software are common responses.
The overall description by Binance matches what security researchers have long warned about regarding social engineering, in which attackers manipulate people instead of breaking software. A convincing job offer is a way to get a trusted person to open the door from the inside.
4. Which Front Companies Were Linked to TraderTraitor?
SEAL identified at least four front companies connected to TraderTraitor's fake recruitment campaigns in 2026. They are citalab.net, citalab.com, bitfit.io and oddium.io. A front company in this context is a business identity created to look like a legitimate employer so that targets accept messages, interviews and files from it.
Fake recruitment is attractive to attackers because it gives them a believable reason to contact employees and to ask them to run software or open documents. Workers in crypto are often approached about new roles, and a request to complete a technical test can seem routine.
By publishing the names of the fronts, SEAL gives companies something specific to check against their records. Security teams can search their logs and messages for contact with those domains, and employees can be reminded to treat unsolicited job approaches with caution.
The scale of the Binance theft makes the question more than an academic one. A loss of $6.3 billion is far larger than the other incidents SEAL cites, and it has pushed exchange security into the center of discussions among operators, investors and officials about how well the industry protects customer funds.
5. Do Other Crypto Heists Show the Same Pattern?
SEAL says that similar multi-stage intrusions lie behind other major incidents. In the $388 million Bitget hack, the attackers had about six weeks of access before they struck. In the $293 million LayerZero and Kelp DAO exploit, the group had about six weeks of access before the vulnerability that led to the theft.
In the $24 million AFX case, the access lasted about three weeks before the bridge exploit. The durations vary, but each case shows a gap between the first compromise and the loss of funds, during which the attackers were present and, apparently, unnoticed.
The comparison supports SEAL's view that these thefts should be understood as campaigns rather than single events. If that view is right, the most useful defenses are those that find intruders early, such as monitoring for unusual behavior and limiting what any one compromised account can reach.
A consistent timeline also helps investigators. If the first compromise can be dated, teams can work backward to find which logins, files and contacts were involved, and they can look for the same signs in other organizations. SEAL's publication of dates and domains is aimed at supporting that kind of cross-checking.
The similarity between cases is described as a pattern, not as proof that the same group was behind each one. SEAL points to common features of the intrusions, such as their staged structure and the delay between entry and theft, and it leaves the question of who was responsible in each case to separate investigations.
6. What Has the FBI Said and How Has North Korea Responded?
The FBI attributed the attack to TraderTraitor in a report published on Saturday. North Korea has rejected the accusation: Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied the claims.
Attribution in cyber incidents is based on technical evidence such as infrastructure, methods and the movement of funds, and it is often disputed by the governments named. The FBI's statement is an official attribution by a U.S. law enforcement agency, while the denial is a political response from Pyongyang.
For the exchange and the wider industry, the dispute does not change the practical lesson. Whoever carried out the theft, the method described by Binance and by SEAL relied on deception of employees and on patient preparation.
Both statements arrive within days of each other and of the SEAL report, which means the public record on the theft is still being assembled from several sources with different perspectives.
7. What Can Exchanges Learn From the Eight-Week Window?
The main lesson is that detection has to cover the period before an attack, not only the attack itself. When intruders can stay hidden for weeks, a company that watches only for large or unusual withdrawals is watching for the final step and may have little time to act.
Practical measures include careful vetting of recruitment contacts, strict separation between employee devices and systems that can move funds, and regular review of who has access to wallet infrastructure. The June incident described by Binance also illustrates why replacing a compromised device may not be enough if the attackers have already learned how the organization works.
None of these steps guarantees safety, and the report does not claim that they do. Its value lies in showing how long a determined group can operate and in giving defenders benchmarks, from three to eight weeks, to measure their own detection speed against.
8. What Happens Next?
No new date for further disclosure has been given. Binance has not published a response to SEAL's estimate, and the exchange's own account of the incident remains the main source on how the breach unfolded.
Readers should watch for any further technical reporting from Binance, additional updates from SEAL about the front companies and any response from law enforcement beyond the FBI's attribution. New findings could confirm, refine or change the eight-week estimate.
For now, the report adds a measurable detail to one of the largest thefts in the history of the industry: the people behind it appear to have been in position for roughly two months before the money moved.
The report is also likely to be read closely by other exchanges and custodians, since the access periods it cites for different incidents give them rough reference points. A firm that would take longer than three weeks to notice a hidden intruder, for example, has reason to review its monitoring.