CZ's security alliance call follows closure of Binance-linked T3 unit

What happened

Security Alliance (SEAL) estimates that the North Korea-linked group TraderTraitor entered Binance's systems roughly eight weeks before the exchange suffered a $6.3 billion exploit on Oct. 29. In a Thursday report, the non-profit cybersecurity organization said the intrusion began sometime in September and that attackers could remain in the environment quietly for extended periods. Cointelegraph reported the estimate. SEAL also identified four front companies tied to TraderTraitor's fake recruitment campaigns in 2026: citalab.net, citalab.com, bitfit.io and oddium.io.

Binance has described the breach as the result of a fake job interview that allowed attackers to compromise an employee device and obtain credentials used to reach its wallet infrastructure. The exchange traced the campaign to June, when another employee's device was compromised. Binance said it detected that earlier incident and replaced the device, but that attackers had already collected information about its team and wallet infrastructure, according to a Tuesday post on X. The FBI attributed the attack to North Korea's TraderTraitor in a Saturday report, while Kim Yo Jong, sister of North Korean leader Kim Jong Un, rejected the accusation.

Separately, Bitcoin.com News reported that the T3 Financial Crime Unit, a two-year-old initiative involving Tether, Tron, TRM Labs and Binance, closed in late August, months before the Binance hack. Bloomberg reported the closure, citing people familiar with the matter. Tron, Tether and TRM Labs confirmed the unit had shut down, while Binance declined to comment. The unit had claimed to freeze more than $450 million in illicit crypto assets, but the report said it had struggled over the past year with slow responses and poor coordination among members. Its X account, which had more than 1,400 followers, was also closed.

Why it matters

The timing has focused attention on industry coordination. After the Oct. 29 hack, Binance co-founder Changpeng Zhao called for a crypto-wide security alliance. According to Bitcoin.com News, he said such a group could spot common attack methods before they spread, share audit findings, pass on lessons from breaches and coordinate faster asset freezes. Freezing illicit assets was also a focus for T3. Tether said that after the Binance hack it froze more than $1.5 billion in USDT stolen from the exchange. The reports do not establish that T3's closure contributed to the Binance breach, but they place the call for a new alliance alongside the end of an earlier multi-company effort.

What the data shows

SEAL's estimates suggest long dwell times in several crypto attacks. It estimated attackers had about six weeks of access before the $388 million Bitget hack, six weeks of access to LayerZero before the vulnerability that led to the $293 million Kelp DAO exploit, and about three weeks before the $24 million AFX exploit, Cointelegraph reported. In the Binance case, SEAL put the access period at about eight weeks. T3's disclosed figures include more than $450 million in frozen illicit USDT, a 43.9% increase in intercepted illicit proceeds in 2025 versus 2024, and work with law enforcement in 23 jurisdictions. Tether's post-hack freeze was more than $1.5 billion in USDT.

Background

T3 launched in September 2024 and Binance joined in September 2025. At the time, Nils Andersen-Röed, then global head of Binance's Financial Intelligence Unit, described membership as a sign of the exchange's commitment to working with industry partners and law enforcement against illicit activity in real time, Bitcoin.com News reported. In May 2026, T3 said it had frozen more than $450 million in tether (USDT) since its launch and had intercepted 43.9% more illicit proceeds in 2025 than in 2024, working with law enforcement across 23 jurisdictions. After the closure, Tron said an unspecified new initiative would come soon, while Tether said it would keep working with TRM Labs. TRM Labs had launched its Beacon Network in 2025, a real-time intelligence-sharing system intended to intercept illicit funds before criminals can withdraw them.

What to watch

Several questions remain open. Cointelegraph said Binance did not respond to a request for comment on SEAL's estimates. It is also unclear whether Zhao's proposed security alliance will take shape, what form Tron's planned initiative will take, and how Tether's continued work with TRM Labs will differ from T3. The FBI's attribution to North Korea and Kim Yo Jong's dismissal of it also leave the dispute over responsibility unresolved. Signals to watch include any Binance response to the SEAL report, details of a new industry-sharing mechanism, and further asset-freeze announcements tied to the stolen funds.

Questions readers ask