Large scale underground storage of CO2 is being deployed worldwide to reduce greenhouse gas emissions to the atmosphere. Modelling studies have investigated the possible risks from the CO2 migrating along faults, but this has not yet been observed. We were able to identify such CO2 migration at a commercial-scale, demonstration CO2 storage project, the Illinois Basin - Decatur Project, including subsequent emergence of the CO2 into overlying permeable layers. Our interpretation resolves previous inconsistencies observed at the project and provides a rare field observation the fluid dynamics of CO2 moving between faults and reservoir lithology. The project had deployed time-lapse 3D vertical seismic profile imaging to study CO2 plume development, interpreted based on the commonly used amplitude attributes. However, factors including survey repeatability, subtle seismic fluid effects and irregular filling of the storage reservoir by CO2 meant that amplitude anomalies due to CO2 were not distinct. Here we apply an alternative interpretation technique to the data based on time shift attributes, resulting in much clearer plume anomalies. This work provides field validations of previously theorised plume behaviours and demonstrates the use of an alternative analysis technique to overcome challenges in interpretation of seismic monitoring data for geological CO2 storage.