SEAL Estimates Binance Intruders Had Eight Weeks of Access

What happened: The nonprofit Security Alliance, or SEAL, estimates that TraderTraitor accessed Binance approximately eight weeks before the October 29 exploit, placing the intrusion sometime in September. Its analysis describes recruitment lures, fraudulent domains and an employee-device compromise, and compares the attack with estimated access periods of six weeks before the $388 million Bitget hack and three weeks before the $24 million AFX exploit. The timeline remains contested: Binance’s own incident report places an engineer’s software installation in June, so SEAL’s estimate should not be presented as an agreed forensic finding.

Why it matters: An estimated eight-week presence shifts the analytical focus from the moment funds left wallets to the earlier opportunities to detect unauthorized access, revoke credentials and scrutinize employee software. The differing June and September accounts also show why initial compromise, later access and final execution need separate treatment when evaluating an incident timeline. For customers assessing an exchange’s response, a credible explanation of how access persisted would add information that a reimbursement announcement alone cannot provide.

Source: Security Alliance Radar.