Binance hackers had 8 weeks of access before $6.3B exploit, Security Alliance estimates

Binance's October 29 breach fits a pattern security researchers have tracked since North Korea-linked operators began using long-dwell intrusions: deep reconnaissance, front companies and patient infrastructure building rather than smash-and-grab theft. Security Alliance ties the tactics to TraderTraitor, a group whose methods diverge from the ‘Contagious Interview’ playbook and more closely resemble the operation behind the $388 million Bitget hack.

Exchanges now face pressure to treat eight weeks of undetected access as a baseline risk rather than an outlier, forcing reviews of internal monitoring, privileged-access logging and anomaly detection that should have flagged reconnaissance long before the $6.3 billion exploit. Traders and institutional counterparties relying on Binance's custody are left reassessing how much latent exposure sits inside systems that looked uncompromised until the theft became public.

Linking this case to Bitget's $388 million loss shows the same actor profile scaling up against larger, better-resourced platforms, undercutting the assumption that size and compliance budgets alone deter state-linked intruders. It is a fair challenge to exchanges that market themselves as secure custodians while sophisticated operators sit inside their infrastructure for weeks, gathering the access needed to execute an eight-figure theft in a single move.

What settles the open questions is whether Security Alliance or Binance publish a full forensic timeline detailing how the eight-week window was missed, and whether Binance discloses concrete changes to detection systems following the $6.3 billion loss. A comparable disclosure after the Bitget hack would show regulators and users whether exchanges are converging on shared defenses against TraderTraitor-style intrusions or still responding case by case.