SEAL Identifies Weeks of Access Before Binance Wallet Compromise

What happened: Security Alliance estimated that North Korea-linked TraderTraitor had approximately eight weeks of access inside Binance before the $6.3 billion October 29 exploit, while Binance said attackers reached wallet-signing and operations infrastructure on October 20. The disclosed entry points included an employee downloading a tampered Homebrew installer while setting up an AI coding tool in June, followed by a software engineer targeted through fake recruitment in September. SEAL also identified four recruitment front companies and compared the case with approximately six-week intrusions preceding the Bitget and Kelp DAO exploits.

Why it matters: The June entry point and October wallet access describe different stages of compromise, so the eight-week estimate should not be treated as the complete duration of every attacker foothold. The chronology suggests a security problem extending beyond transaction approval: software installation, recruitment interactions and movement between internal systems all warrant scrutiny when access persists for weeks. The AI connection is also specific—a coding-tool setup featured in an initial compromise—while Elliptic’s separate laundering findings provide no evidence that autonomous AI directed the subsequent fund movements.

Sources: Cointelegraph; Security Alliance