DOJ to seize $1.2 bn stolen from Binance, disrupt North Korea theft - scanx.trade
The US Department of Justice is preparing to seize $1.2 billion worth of cryptocurrency stolen from Binance in a sophisticated laundering scheme orchestrated by North Korean state-sponsored actors.
The US Department of Justice (DOJ) is preparing to seize $1.2 billion worth of cryptocurrency stolen from Binance, according to recent reporting on actions to disrupt North Korea's cryptocurrency theft infrastructure. This seizure represents a significant recovery effort against state-sponsored cybercriminals following earlier disclosures by blockchain analytics firm Elliptic.
Laundering technique
Elliptic identified a sophisticated scheme involving at least six meme tokens created on the NEAR Protocol between November 5 and November 7. Each token was paired with stolen NEAR tokens through separate liquidity pools, allowing illicit funds to move without direct transfers between wallets.
The technical structure of the liquidity pools served as the primary obfuscation tool. "At no point do the stolen funds move directly from a buying wallet to a collecting wallet, because the pool sits in between," Elliptic stated. This intermediary step ensures that to a casual observer, the collecting wallets appear to be ordinary traders selling tokens for profit, rather than recipients of stolen capital.
The tokens featured images of a monkey, duck, chimpanzee, fox, and gold badge. One specific token displayed Elon Musk beneath an "Elon 2028 President" banner, though Elliptic confirmed there is no evidence linking Musk to the creation of these assets.
Scale of losses
Binance estimated total losses from the breach at roughly $6.3 billion, a figure more than four times the amount lost in the Bybit hack. The exchange stated it covered approximately $6 billion, or 95% of the affected amount, by purchasing replacement tokens with company funds.
The FBI attributed the attack to North Korean state-sponsored cybercriminals. In response, North Korea described the accusation as "absurd rhetoric," alleging that the U.S. is attempting to mislead international public opinion.
Kaiser Ng has decided to pursue a new venture after more than five years at Binance, with a transition plan implemented over the last half year.
Recurring patterns
Elliptic noted that this specific laundering technique was previously observed in funds stolen from the cryptocurrency exchange Bybit in 2025. The reuse of the meme token liquidity pool method suggests a standardized operational procedure employed by these actors to evade blockchain analysis tools.
The reported DOJ seizure of $1.2 billion represents approximately 19% of the total estimated losses, indicating a substantial but partial recovery of assets. While North Korea denies involvement, the FBI's attribution and Elliptic's tracking of identical technical signatures across two major exchanges highlight a persistent and sophisticated infrastructure dedicated to laundering large-scale digital asset thefts.
Binance has completed coverage of all assets impacted by the breach, publishing a new Proof of Reserves snapshot to demonstrate financial integrity. Users can now independently verify that their assets are backed at a minimum of 1:1 ratio once the zero-knowledge proof is generated.
Related
