Binance hackers had 8-week intrusion window before $6.3B exploit: SEAL
The cybersecurity company flagged similar multi-stage intrusion patterns behind other high-profile crypto heists, including the $388 million Bitget hack.
Updated (Nov. 6 at 05:03 p.m. UTC): This article has been corrected to clarify the timeline of the Binance hack. The article also includes a statement from a Binance spokesperson.
Nonprofit cybersecurity organization Security Alliance (SEAL) estimates that North Korea-linked hackers compromised a Binance employee’s device about eight weeks before the exchange’s $6.3 billion exploit on Oct. 29, although Binance said the broader attack campaign began in June and that the hackers did not gain access to additional wallet infrastructure devices until Oct. 20.
The hacking group compromised a Binance software engineer’s device in September through a fake recruitment scheme, wrote SEAL in a Thursday report, adding that threat actors can navigate compromised systems with a “high degree of stealth over prolonged periods of time” after initial intrusion. SEAL’s eight-week estimate refers to the September-to-October intrusion window, rather than the beginning of the broader campaign described by Binance.