SEAL estimates North Korean hackers spent about eight weeks inside Binance before theft

The Security Alliance (SEAL), a nonprofit group of security researchers, estimates that the North Korean hackers behind the Binance theft were inside the exchange's systems for about eight weeks before the money moved. In a profile of the group, TraderTraitor, published on November 5, 2026, SEAL said the attack on October 29 took roughly $6.4 billion; Binance's own figure, which we reported on November 4, was $6.3 billion.

SEAL's eight weeks run from September to October 29, with the start date marked as unknown. Binance's account of the earlier steps is in our earlier report.

Four thefts, four waiting periods

SEAL tabulated how long the same group stayed inside each victim before stealing. It lists about six weeks at LayerZero (March 6 to April 18), about three weeks at AFX (July 9 to July 22), about six weeks at Bitget (August to September 24) and about eight weeks at Binance. For Bitget, SEAL says the earliest malicious activity in the available logs gave the group at least 24 days of dwell time before the theft on September 24, 2026.

The Binance and Bitget start dates are approximate: SEAL writes them with question marks, because neither company has published the first day of malicious activity.

What SEAL says it can and cannot see

SEAL's profile rests on the group's earlier campaigns, not on Binance's own technical evidence. It states that Binance has not yet provided any meaningful technical indicators, and it says the timeline and details Binance gave match the pattern of a campaign that uses fake employers. It identifies the engineer Binance calls Engineer B, who had two rounds of interviews with different people, as consistent with that pattern, but notes that Binance has not provided the exact URLs involved.

SEAL describes the lure as built to survive scrutiny: front companies that pass basic diligence, real recruiters on real phone calls, and a coding task that involves simply cloning a repository. It says the group keeps a high degree of stealth over prolonged periods of time.

Why the length of the stay matters to SEAL

The report's main argument is about detection, not about the lure. "In every case the intrusion was there to be found," SEAL writes, and it advises companies to monitor logs for lateral movement, privilege escalation and credential abuse during the weeks between the first compromise and the theft, rather than only at the point of entry.

The estimate is outside research, and Binance has not confirmed it

The eight-week figure is SEAL's estimate. Binance's own account, which we reported on November 4, describes a tool compromise in June and a fake recruitment in September. SEAL's profile does not say that Binance has confirmed the eight-week figure.

A number that makes the quiet weeks the story

We think the useful reading of SEAL's table is that these thefts are slow, and a slow theft is a chance for the victim. Our view as the crypto desk is that custody and security events matter more to this market than a day's price move: a firm that can show how it would have noticed week three has a stronger claim on customer trust than one that can only show how it recovered.

The opportunity is that the same pattern, repeated across four companies in 2026, gives exchanges a concrete benchmark to test their monitoring against. The threat is that Binance has not yet published the technical indicators other firms need to run that test. We do not forecast price levels, and nothing here says what any token will do. Our view would change if Binance published logs that put the first intrusion later than SEAL's estimate, or if a further report found an earlier one.

The view in this final section is FinanceInTime's editorial opinion, for information only. It is not investment, tax, legal or other advice, and it does not take your circumstances into account. Forecasts are uncertain and past results do not guarantee future ones.