US Justice Department Wins Court Approval to Seize $1.2 Billion in Stolen Binance Crypto

The US Department of Justice (DOJ) said it has court authority to seize or restrain more than $1.2 billion in cryptocurrency that North Korean hackers stole from Binance. The funds form part of more than $2.7 billion frozen after the October theft, which officials said stopped about half of the heist.

• The DOJ said North Korean military hackers, called TraderTraitor by the FBI, stole more than $6 billion in virtual assets from Binance on or about October 29.
• Of more than $2.7 billion frozen by US government and private-sector efforts, the DOJ said courts have authorized seizure or restraint of more than $1.2 billion.
• In a separate action, the FBI seized cloud infrastructure and more than 900 webcam videos tied to a deepfake scheme it linked to over $400 million in crypto theft.

What the Justice Department announced on the Binance theft

The DOJ said members of the North Korean military stole more than $6 billion worth of virtual assets from Binance, the large crypto exchange. Binance has said it covered $6.34 billion in affected assets since the attack.

Assistant Attorney General A. Tysen Duva of the DOJ Criminal Division said the department and its partners were able to “immediately halt about half of this historic breach” by freezing assets before they moved out of reach. The more than $2.7 billion freeze combines United States government and private-sector work. The underlying court papers were not released with the announcement.

What the court authorization changes

The $1.2 billion comes from funds already frozen after the theft, which Binance put at about $2.85 billion on November 3. Most of the frozen funds are stablecoins locked by their issuers. Tether said it froze more than $1.5 billion in USDT, and Circle said it froze about $1.1 billion in USDC. A freeze stops the funds from moving. The court authorization lets the government seize them and move toward forfeiture, a process in which a court transfers assets tied to crime to the government.

About $1.5 billion of the frozen funds is not yet covered by a court order made public, and no forfeiture complaint naming the wallets behind the $1.2 billion had been released as of November 13.

How Binance covered customer losses

Binance said it completed coverage of the assets hit in the breach using company funds, not recovered coins. The exchange said users were made whole from its Secure Asset Fund for Users, part of its futures insurance fund and its treasury. The government effort to recover the stolen coins runs separately.

Binance in Coincub Data

Coincub’s registry lists 15 companies under the Binance brand across 12 countries, with its headquarters in the United Arab Emirates. Binance.com is regulated by Abu Dhabi Global Market’s Financial Services Regulatory Authority through three licensed entities. About 35% of the exchange’s 21.1 million unique monthly visitors come from countries where Binance holds a license.

FBI alert and the ongoing trace

The DOJ said TraderTraitor actors are still moving the stolen assets through crypto bridges, mixers and exchanges, and that tracing, seizure and forfeiture work continues. The FBI, the US Secret Service and IRS Criminal Investigation (IRS-CI) issued a Cyber Alert attributing the theft to North Korea. It urged crypto service providers to block transactions with or derived from addresses the hackers use.

The FBI Los Angeles Field Office, Cyber Division and Virtual Asset Unit lead the Binance recovery with the Secret Service and IRS-CI.

Separate FaceStealer deepfake case in California

The US Attorney’s Office for the Central District of California and the FBI announced the seizure of cloud infrastructure used in a campaign the FBI calls FaceStealer. The FBI said it led to more than $400 million in crypto theft over 18 months and targeted open-source software maintainers, apparently to enable supply-chain attacks.

The FBI said North Korean hackers, publicly known by names including APT38 and BlueNoroff, send meeting invites from hijacked accounts on platforms including Telegram, LinkedIn, Slack and Discord. Calls run on fake versions of Zoom, Microsoft Teams and Google Meet. Hackers play prerecorded video of someone the target knows, or a deepfake of a known crypto figure, then send a malware “fix” for a staged technical error. Some thefts came months to more than a year after the first compromise. Under a federal warrant, the FBI seized more than 900 victim webcam videos.

Principal Deputy Assistant Attorney General for National Security M. Scott Proctor said North Korea funds its regime and weapons program through crypto theft.

What happens next

Proctor said the National Security Division will use every tool at its disposal to “seize and return North Korea’s ill-gotten gains.” A forfeiture case naming the wallets would be the next court filing. The DOJ has given no timeline for returning any funds.