Binance estimated the Oct. 29 incident's impact at about $6.3 billion, while Security Alliance (SEAL) places the intruder's access to its systems roughly eight weeks earlier, in September.
Binance said the attacker gained control of an employee's device during a sham hiring interview and used credentials from it to reach wallet infrastructure.
Binance's review separately found activity involving another employee's device dating to June. An earlier EconoTimes report said Binance's initial review flagged a DevOps engineer's laptop as a possible entry point.
The Federal Bureau of Investigation (FBI) said TraderTraitor carried out the intrusion; SEAL links the group to North Korea. SEAL's account of 2026 recruitment efforts named four domains — citalab.net, citalab.com, bitfit.io and oddium.io — among connections between TraderTraitor and at least four shell companies.
Across SEAL's other cases, its access estimates were six weeks for Bitget and for the LayerZero/Kelp DAO episode, with AFX at about three weeks.
Binance has said it would absorb the financial impact of the stolen funds rather than pass it to users.
