SEAL: Binance Attacker Had Access ~8 Weeks Before $6.3B Hack

Cointime reports: The attacker behind the $6.3 billion Binance theft on Oct. 29 gained access to the exchange’s systems roughly eight weeks earlier, in September, and maintained long-term stealth after the initial breach, Security Alliance (SEAL) estimated in a Nov. 5 report. SEAL listed four shell-company domains used in fake recruiting for 2026: citalab.net, citalab.com, bitfit.io and oddium.io. It also estimated pre-access periods of about six weeks at LayerZero and Bitget, and three weeks at AFX. Binance had not responded to a request for comment.