Binance Hackers Were Inside for Eight Weeks, and $3.1B Is Still Not Laundered

Hackers linked to North Korea got onto a Binance employee's device about eight weeks before the $6.3 billion theft. That is the conclusion of the nonprofit Security Alliance (SEAL) in a report published on Thursday. The way in was through engineers' laptops, not the exchange's code.

What exactly did the SEAL report show?

SEAL estimates that a Binance developer's computer was compromised in September through a fake job offer. Once inside, attackers can move around a network unnoticed for months, and that is what happened here. About eight weeks passed before the theft on October 29.

Binance itself clarified the timeline. A spokesperson said the first devices were hit back in June and September, but the attackers had no access to wallets until October 20. So SEAL's eight weeks describe the window between September and October, not the whole campaign.

How did they get to the wallets?

The scheme is easy to trace by date. Here is what the exchange has said.

• June: an employee downloaded a tampered Homebrew installer while setting up an AI coding tool. Binance spotted the incident and replaced the device, but the hackers had already gathered data on the people who work on wallet infrastructure.
• In September an engineer was targeted with a fake recruitment offer and ended up with an infected computer. SEAL found at least four front companies that North Korea used for such campaigns in 2026.
• On October 20 the attackers used that computer and an internal AI tool to take over the devices of two engineers responsible for wallets.
• They found a deployment permission token there. It was used on October 29.

A fake job, a tampered installer, an internal AI tool. Nobody broke any cryptography. The hackers used ordinary developer routine.

Is this a one-off?

No, and that is the real danger. SEAL found a similar pattern in several high-profile thefts. Before the $388 million Bitget hack, the attackers had about six weeks of access. Before the $293 million Kelp DAO exploit they spent roughly as long inside LayerZero. The smaller $24 million AFX hack was preceded by about three weeks.

The longer hackers walk around a network, the better they know where the permission to move funds sits. The FBI named North Korea's TraderTraitor group as the author of the attack on Saturday, while Kim Yo Jong, sister of the North Korean leader, rejected the accusation.

How much of the loot has been laundered?

Less than you might expect. According to Elliptic analysts, about $3.11 billion still sits on the thieves' addresses, mostly in Ethereum and Bitcoin. The 18,270 BTC was split across 19 addresses on the day of the hack and has not moved since. The nine largest Ethereum addresses, holding 89% of the stolen ETH, have been silent since October 30.

Laundering is already under way. The hackers have used more than 20,000 wallets on 16 blockchains. The biggest stream, about $220 million in TRX, went through Tron: one wallet sent 684.6 million TRX to hundreds of new addresses within 51 hours, including through the night in Pyongyang. All of the stolen SOL (about $87 million) has been swapped, bridged or mixed. Around $50 million of the XRP has been converted, and $226 million is still waiting. Part of the bitcoin appeared via THORChain, and 33 BTC went through coinjoins.

What should an exchange user take from this?

The freeze worked. Stablecoin issuers such as Tether and Circle blocked tokens within an hour, and 44% of the haul ended up out of the hackers' reach. After the Bybit hack in February 2025, only about 3% was frozen.

For anyone who keeps USDT on an exchange and cashes out to hryvnia through P2P, the lesson is mundane. Do not store more on the exchange than the next deal needs, and do not open job offers from unknown companies on a work laptop. Judging by the report, that is exactly where this story began.