North Korea-linked hackers maintained access to Binance systems for roughly eight weeks before carrying out the exchange's $6.3 billion exploit on Oct. 29, according to nonprofit cybersecurity organization Security Alliance (SEAL). Binance, however, says the broader attack campaign began in June, and that the hackers did not gain access to additional wallet infrastructure devices until Oct. 20.

In a Thursday report, SEAL wrote that the hacking group compromised a Binance software engineer's device in September through a fake recruitment scheme, adding that threat actors can navigate compromised systems with a “high degree of stealth over prolonged periods of time” after the initial intrusion. SEAL's eight-week estimate refers to the September-to-October intrusion window, rather than the beginning of the broader campaign described by Binance.

Cointelegraph contacted Binance for clarification on the timeline. A spokesperson said the initial device compromises occurred in June and September, but that the attackers did not gain the access needed to reach wallet operations until Oct. 20.

“As outlined in our announcement, the initial device compromises occurred in June and September, but the attackers did not gain the access needed to reach wallet operations until October 20, when they used that foothold to move laterally and obtain access to additional devices and credentials,” the spokesperson said.

SEAL identified at least four “front companies” associated with TraderTraitor's fake recruitment campaigns in 2026, including citalab.net, citalab.com, bitfit.io and oddium.io — domains that presented the outfits as legitimate employers to their targets.

Binance traced the attack campaign back to June, when a separate employee's device was compromised after the employee downloaded a tampered Homebrew installation (an open-source package manager used to install software on macOS and Linux) while attempting to install an AI coding tool, as previously reported. The exchange detected the incident and replaced the device, rotating related credentials. However, the attackers had already obtained information about employees working on Binance's wallet infrastructure, according to a Tuesday X post.

On Oct. 20, attackers used the compromised computer of the engineer targeted in September, along with an internal AI tool, to gain control of two wallet infrastructure engineers' devices, according to Binance. They subsequently discovered a deployment permission token, which was used during the Oct. 29 exploit.

SEAL's analysis pointed to similar multi-stage intrusion patterns in other high-profile crypto hacks. It estimated that attackers had about six weeks of access before the $388 million Bitget hack, six weeks of access to LayerZero before the vulnerability that led to the $293 million Kelp DAO exploit, and about three weeks before conducting the $24 million AFX exploit. Taken together, the cases frame long dwell times between initial access and execution as a recurring feature of major crypto intrusions rather than an anomaly unique to Binance.

The US Federal Bureau of Investigation attributed the attack to North Korea's TraderTraitor in a Saturday report. Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations, leaving responsibility for the exploit publicly contested between Washington and Pyongyang. With the two governments offering directly opposed accounts, further disclosures from Binance, SEAL or US agencies could add detail on how the intrusion unfolded between June and October.

Related: Binance hack may be 'temporary setback' for crypto, Grayscale's Pandl says