SEAL: North Korea's TraderTraitor lurked for about 8 weeks before attacking Binance.

PANews November 6 news: According to SEAL (Security Alliance), the disclosed details of Binance's approximately $6.4 billion theft on October 29 are consistent with the "shell company + multiple rounds of interviews" attack pattern commonly used by the North Korean hacker group TraderTraitor. This group is not the same gang as Contagious Interview, which also uses recruitment as bait. SEAL stated that over the past year, TraderTraitor also used a malicious Terraform coding test to breach LayerZero, used a self-built malicious GitLab repository to breach AFX, and is suspected of exploiting a 0day vulnerability in a third-party security product to breach Bitget. It lay dormant inside the above organizations for approximately 3 to 6 weeks each, and about 8 weeks at Binance. SEAL also disclosed shell company domains such as citalab, bitfit, and oddium.