Binance Hack Timeline: Security Alliance Says 8 Weeks,…

The Security Alliance put about eight weeks of attacker access on the Binance hack timeline in a report published Thursday, and marked the start date unknown in the same line it gave the figure. Binance’s own incident report, released a day earlier, supplies three separate points at which the Binance hack timeline could be started.

The Security Alliance post gives the Binance intrusion about eight weeks, writing the start as “Sept ??” and the end as 29 October. Both the tilde on the duration and the question marks on the month are the researchers’ own, and they shape every Binance hack timeline that has run since.

Three Starting Points for the Binance Hack Timeline

Binance says a Wallet DevOps engineer, identified as Engineer A, downloaded a tampered Homebrew installer in June while trying to set up an AI coding tool. Its security team flagged the anomaly, replaced the device and rotated credentials, but the company believes the episode exposed Engineer A’s role and links to colleagues working on wallet infrastructure.

A second engineer was approached in September through a legitimate recruitment platform by someone posing as a project director, sat through live video interviews including one with a supposed chief executive, and downloaded an assignment repository onto a work computer. Malicious code ran during setup and reached an attacker-controlled server without triggering the endpoint protection then in place.

On 20 October the attackers used that machine and an internal AI tool to take control of two more wallet engineers’ computers, finding a container deployment token on one of them. The theft followed nine days later.

Binance does not claim the attackers held access continuously across those stages, which is the gap any Binance hack timeline has to bridge.

Investor Takeaway

Security Alliance Was Arguing About Attribution

The dwell-time line that seeded this week’s Binance hack timeline coverage is one item in a four-point list, and it is not what the researchers wrote the post to say. Their argument is that much of the industry is modeling the wrong adversary.

TraderTraitor, also tracked as Jade Sleet and UNC4899, is described in the post as the most capable North Korean group working against crypto infrastructure. Contagious Interview is a separate North Korean subgroup that also uses fake job interviews to deliver malware. The post argues the two differ in preparation, operators and post-exploitation, so defenses designed for one will fail against the other.

TRM, Pangolin Intelligence, Elliptic, Chainalysis and the FBI all attributed the attack to TraderTraitor. Earlier FinanceFeeds coverage set out how one fake interview opened $6.34 billion and how Binance blocked 57 suspected North Korean attempts earlier in 2026.

The post also separates the distinct routes the group uses to get its first foothold. One cluster approaches cloud and DevOps engineers with a coding assessment that installs a trojanized HashiCorp Terraform provider, carrying the backdoors researchers call FLATROOF and ROOFDECK onto the machine. Another runs through front companies and real third-party recruiters, with one intrusion reaching a self-hosted GitLab instance and the option of exploiting CVE-2025-48384, a carriage-return flaw in Git submodule handling that Red Hat scores 8.0.

Every Dwell-Time Figure in the Set Is an Estimate

The post lists four 2026 intrusions it attributes to the same group, and every duration carries a tilde. Two of the four give no start date. The AFX entry is given as about three weeks for 9 July to 22 July, a span of 13 days.

The researchers are explicit that Binance has released no meaningful technical indicators, which is the missing piece in any Binance hack timeline, and they await the final Bitget post-mortem. Bitget lost $387.5 million on 24 September to a zero-day in third-party security products, with no private keys taken. The pattern across the set is access to internal tooling rather than key theft, which also matches what FinanceFeeds found when 322 incidents were counted across the year.

The Binance Hack Timeline Ends With a 161-Minute Window

Between 17:15 and 19:56 UTC on 29 October the attackers reached a third engineer’s computer, used the stolen credentials to deploy a container and triggered the script that moved the money. That window runs 2 hours and 41 minutes, the one stretch of the Binance hack timeline that Binance has dated to the minute.

Roughly 50 signing transactions went through an internal wallet signing service using nonce manipulation and malicious delegations. Under EIP-7702 a delegation persists on-chain after the transaction that set it, so halting withdrawals did not remove the ones already in place, and Binance needed a specialized procedure to revoke them. Five hot wallets moved 233.46 million XRP between 20:05 and 20:09 UTC, and the last unauthorized transfer of 2,961.9 ETH finalized at 23:56 that night.

Binance puts the impact at about $6.34 billion, with roughly $2.85 billion frozen or intercepted and 98% of affected token assets replenished by 31 October, as set out in our one week on account. The Fed and the OCC called US banks about their own systems on Monday.

Investor Takeaway