Security Alliance (SEAL) estimates that North Korea-linked TraderTraitor gained access to Binance’s systems in September, about eight weeks before the $6.3 billion exploit on Oct. 29. The estimate does not establish when the attackers first entered the systems. Binance did not respond to a request for comment on SEAL’s estimates by publication.
Binance said a fake job interview led to an employee device being compromised and credentials being stolen to breach its wallet infrastructure. It traced the campaign to a separate employee-device compromise in June; Binance said it detected that incident and replaced the device, but attackers had already gathered information about its team and wallet infrastructure. The FBI attributed the attack to TraderTraitor, while Kim Yo Jong dismissed the accusation.
