Odaily reports: The nonprofit cybersecurity organization Security Alliance (SEAL) estimates that the North Korea-linked hacking group TraderTraitor had gained access to Binance's systems about 8 weeks before the $6.3 billion attack that occurred on October 29. In its report, SEAL noted that the attackers may have breached the systems at some point in September and operated covertly for an extended period after the initial intrusion.
SEAL also found that TraderTraitor was associated with at least 4 shell companies in a 2026 fake recruitment campaign, namely citalab.net, citalab.com, bitfit.io, and oddium.io. The organization estimates that the attackers had about 6 weeks of access before the $388 million attack on Bitget, had accessed LayerZero for about 6 weeks before the $293 million attack on Kelp DAO, and lay dormant for about 3 weeks before the $24 million attack on AFX.
Binance attributed the attack to a fake job interview, saying the attackers used it to take control of an employee's device and steal credentials, thereby breaching the exchange's wallet infrastructure. Binance also said the campaign can be traced back to June, when another employee's device was compromised; the U.S. Federal Bureau of Investigation attributed the attack to TraderTraitor. (Cointelegraph)
