Hackers spent weeks operating inside Binance's internal systems before carrying out the exploit behind what is being described as the largest cryptocurrency theft in history, according to a report published by SEAL (Security Alliance), an industry-led crypto security body.

Binance, the world's largest cryptocurrency exchange, is investigating a security breach after on-chain data showed billions of dollars in digital assets moving from wallets linked to the platform to newly created external addresses. Reports have put the total at more than $6 billion, which would make it the largest ever crypto attack in history, well above the Bitget theft that had been 2026's biggest incident to date.

According to blockchain intelligence firm Arkham, the hackers held over $5.7 billion in assets stolen from Binance, including:

• $1.5 billion in Bitcoin (BTC)
• $900 million in Ether (ETH)
• approximately $1.5 billion in Tether (USDT)
• over $800 million in USD Coin (USDC)

MILESTONE | Binance Gets Hacked in the Largest Crypto Exploit in History #Binance, the world's largest cryptocurrency exchange, is investigating a security breach after on-chain data showed billions of dollars in digital assets moving from wallets linked to the platform to newly created external addresses. Reports put the figure at over $6 billion making it the largest ever crypto attack in history. According to blockchain intelligence firm, #Arkham, the hackers held over $5.7 billion stolen from Binance including: $1.5 billion in $BTC $900 million in $ETH ~$1.5 billion in $USDT Over $800 million in $USDC Details: #BinanceHack #CryptoHack #CryptoHacks2026 #CryptoMilestone — BitKE (@BitcoinKE) October 30, 2026

In its report, SEAL said the Binance intrusion likely began with malware delivered through a fraudulent job interview targeting a developer's device. It also cautioned against confusing TraderTraitor with another North Korean hacking cluster, Contagious Interview, which uses similar recruitment lures but employs different tactics. The distinction carries practical weight: because both campaigns reach staff through fake job offers, scrutinizing interviewers and the companies behind them is the most direct check against this style of intrusion.

The group has also been linked to attacks involving LayerZero, Bitget and AFX. SEAL documented approximately six weeks of access inside LayerZero, three weeks at AFX, and at least 24 days of access to Bitget's infrastructure ahead of a theft executed on September 24. Bitget was reported at the time to have lost over $350 million in that incident, the biggest crypto hack of 2026 so far.

The report identified several suspected fake recruitment companies used in the campaigns, including CitaLab, BitFit and Oddium, a detail that underlines how these campaigns targeted people and hiring processes rather than breaking cryptography directly.

SEAL said TraderTraitor's operations were characterised by prolonged reconnaissance, lateral movement across company systems, and abuse of legitimate signing infrastructure, rather than the outright theft of private keys. That distinction matters for defenders: intrusions that move funds through legitimate signing and approval channels can resemble routine operations, one reason SEAL warns a compromised employee device can remain unnoticed for weeks.

It urged crypto companies to strengthen monitoring of developer devices, cloud credentials, withdrawal systems, and third-party security products, warning that the compromise of an employee's device could remain undetected for weeks.

Across the incidents examined, SEAL found that the group relied on recruitment-themed social engineering as its initial access method, with intrusions persisting for weeks before any funds were moved. With Binance's investigation still ongoing, developments to watch include the exchange's findings on how the access was sustained, further on-chain movement of the stolen assets — which firms such as Arkham have so far tracked through blockchain data — and how widely exchanges adopt SEAL's recommended monitoring of developer devices, cloud credentials and withdrawal systems.