Binance hackers may have been in systems for 8 weeks before billions were robbed

The hackers behind the massive attack on Binance may have had access to the crypto exchange's systems for as long as eight weeks before they struck. This is according to new research by security organisation Security Alliance (SEAL).

The October 29 attack stole about $6.3 billion worth of crypto. The new findings raise questions about how long the attackers could go unnoticed.

According to SEAL, the North Korean hacking group TraderTraitor allegedly gained access to Binance's systems in September.

The attackers would then have collected information for weeks and expanded their access. It was not until 29 October that they proceeded to the actual theft.

The eight-week period is an estimate by SEAL. Binance has not yet confirmed that the hackers actually had access for that long.

The crypto exchange previously disclosed how the attackers could penetrate. Through a fake job interview, an employee was persuaded to download malicious software. This gave the hackers access to internal systems.

It is striking that Binance discovered a separate attack back in June. Another employee had then installed infected software unnoticed.

The company replaced the affected device and revoked the affected access data. But according to Binance, the attackers had already gathered information about employees and the systems used to manage crypto wallets.

That knowledge could later be used to prepare the multi-billion dollar heist.

According to SEAL, TraderTraitor has been using fake vacancies for a long time to attack employees of crypto companies.

The security organization discovered at least four fake companies that were used for such attacks in 2026.

The hackers pretended to be recruiters and approached employees with attractive vacancies. During the application process, they tried to get victims to open infected files.

Once inside, the attackers could try to gain access to increasingly sensitive parts of the business.

According to SEAL, the attack on Binance fits into a broader pattern. With the hack of crypto exchange Bitget, in which about 388 million dollars were stolen, attackers presumably had access for six weeks before they struck.

Even in attacks on LayerZero and AFX, hackers would have penetrated weeks earlier.

The US FBI has attributed the Binance hack to TraderTraitor, a hacking group that the FBI says has ties to North Korea. Pyongyang denies involvement.

Binance has taken several security measures in the meantime. The company has rebuilt affected systems, replaced access credentials and introduced additional controls.

The crypto exchange is also working with external security experts on further research. According to Binance, customers should not pay for the financial damage.

SEAL emphasizes that the attack exposes an important problem. Keeping hackers out is not enough. Crypto companies should also be able to detect suspicious activity when attackers have already gained access.

At Binance, according to the new estimate, the hackers may have had almost two months to prepare their attack.