Binance Hackers Had 8-Week System Access Before $6.3B Exploit
Security Alliance estimates attackers lurked inside Binance infrastructure for eight weeks before executing the $6.3B breach, mirroring tactics seen in other major crypto heists.
Hackers responsible for the $6.3 billion Binance exploit had unauthorized access to the exchange's systems for approximately eight weeks before carrying out the attack, according to estimates from Security Alliance, a cybersecurity firm tracking threats in the digital asset space.
The extended dwell time — the period between initial intrusion and the execution of an attack — points to a carefully staged operation in which bad actors likely mapped internal infrastructure, identified vulnerabilities, and positioned themselves before striking. Security Alliance flagged this multi-stage intrusion pattern as a hallmark of sophisticated, state-level or organized criminal groups operating in the cryptocurrency sector.
Read more AI Data Center Debt Surge Rattles Bond Markets in 2025 →
The firm drew parallels between the Binance breach and other high-profile crypto thefts, specifically citing the $388 million Bitget hack as sharing a similar operational fingerprint. The overlap in tactics suggests a possible common threat actor or a widely adopted playbook circulating among advanced persistent threat groups targeting crypto exchanges.
The findings underscore a persistent challenge for digital asset platforms: perimeter defenses alone are insufficient when attackers are willing to invest weeks or months quietly escalating privileges and evading detection. Security professionals have long emphasized that detecting lateral movement during the dwell period — rather than at the point of exfiltration — is critical to limiting damage in such intrusions.
Continue reading at Cointelegraph.
