North Korea-linked hacking group TraderTraitor reportedly maintained access to Binance's internal systems for approximately eight weeks before the October 29, 2026 attack that resulted in an estimated $6.4 billion in losses. A November 5 report by the Security Alliance (SEAL) reveals that the attackers relied on prolonged infiltration, social engineering, and malicious coding assignments to compromise cryptocurrency companies.
According to SEAL, the Binance intrusion likely began when attackers used a fraudulent job interview to deliver malware to a developer's device. The compromised system provided an entry point into the exchange's internal infrastructure. The report also warns against confusing the Trader traitor with another North Korean-linked hacking group, Contagious Interview. Although both use fake recruitment opportunities to target developers, their operational methods differ.
TraderTraitor's activities extended beyond Binance. SEAL identified suspected intrusions involving several crypto companies, including:
- LayerZero: Approximately six weeks of access.
- Bitget: At least 24 days of access before a September 24 theft.
- AFX: Approximately three weeks of access.
The report also identified suspected fake recruitment companies, including CitaLab, BitFit, and Oddium, allegedly used to make fraudulent employment opportunities appear legitimate. SEAL said the group's operations involved prolonged reconnaissance, movement across internal company systems, and abuse of legitimate signing infrastructure. This approach allowed attackers to exploit trusted systems without necessarily stealing private keys directly.
The security organization has urged crypto companies to improve monitoring of developer devices, cloud credentials, withdrawal systems, and third-party security tools. The report highlights a security problem extending beyond the moment an exchange is attacked. Hackers can spend weeks inside company infrastructure before carrying out an exploit, making employee security, internal monitoring, and early threat detection critical to protecting cryptocurrency platforms.
