SEAL Narrows Binance Breach Timeline to September Foothold Before $6.3B Hit

The clock on Binance's $6.3 billion exploit started ticking in September, not June, according to Security Alliance (SEAL). The security outfit estimates a Binance software engineer's device was compromised that month — about eight weeks before the Oct. 29 drain. That September foothold is the checkpoint SEAL is pointing to, not the opening move of a longer campaign.

Binance's own account shows two separate employee device compromises, one in June and one in September. The exchange says attackers only reached the systems needed for wallet operations on Oct. 20, then exploited a deployment permission token on Oct. 29. That later date adds a marker past the timeline Binance co-CEO Richard Teng gave earlier, which placed the intrusion's beginning in June.

According to SEAL, the September compromise came through a fake recruitment pitch. The group named four front companies tied to TraderTraitor's fake hiring campaigns during 2026: citalab.net, citalab.com, bitfit.io and oddium.io. SEAL also described attackers who camped inside compromised systems for long stretches without drawing attention.

The June thread runs through a wallet DevOps engineer, per Binance, who downloaded a tampered Homebrew installation while setting up an AI coding tool. Binance says it spotted the intrusion, swapped out the machine and rotated credentials — but by then attackers had already learned which employees worked on wallet infrastructure. Four months later, Binance says, attackers pivoted from the September engineer's computer using an internal AI tool, compromising two wallet infrastructure engineers' devices and lifting the deployment permission token.

The FBI has attributed the attack to North Korea-linked TraderTraitor. SEAL frames it as a repeat of a familiar pattern: it measured the attackers' access at about six weeks ahead of the $388 million Bitget hack, a similar stretch at LayerZero before the vulnerability behind the $293 million Kelp DAO exploit, and roughly three weeks before the $24 million AFX exploit.

For Binance, the takeaway is a timeline with more stops than first disclosed — and a breach that unfolded in stages, each one buying the intruders time.