DOJ Wins Court Authority to Seize $1.2 Billion of North Korea’s Stolen Binance Crypto as Freezes Top $2.7 Billion

The Department of Justice announced on Thursday that it has obtained court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance. This action is part of a joint effort with private-sector partners to freeze over $2.7 billion in assets, officials said. The freeze aims to halt about half of the historic breach that occurred on or around October 29.

Members of the North Korean military, referred to by the FBI as TraderTraitor, stole more than $6 billion worth of virtual assets from Binance. This figure is below the $6.34 billion amount Binance has covered since the attack. The exchange stated it had completed coverage of the assets hit in the breach, replacing the tokens from company funds rather than recovering the stolen coins.

Assistant Attorney General A. Tysen Duva of the DOJ’s Criminal Division said the department and its partners were able to “immediately halt about half of this historic breach” by freezing stolen assets “before they got beyond law enforcement reach.” The freeze of more than $2.7 billion is a joint figure for U.S. government and private-sector efforts. Of that amount, the DOJ said it has already obtained court authorization to seize or restrain more than $1.2 billion.

The $1.2 billion is not newly recovered money but comes out of the roughly $2.85 billion Binance said on Nov. 3 had been frozen or intercepted. Thursday’s court authorization is the legal step that lets the government move toward taking ownership of those funds through forfeiture. Until now, the funds had simply been frozen at the token issuers.

The DOJ said TraderTraitor actors are still moving the stolen assets through cryptocurrency bridges, mixers and exchanges. Tracing, seizure and forfeiture work continues. Last week, on Oct. 31, the FBI, with the U.S. Secret Service and IRS Criminal Investigation, issued a Cyber Alert attributing the theft to North Korea. The alert urged virtual asset service providers to block transactions with or derived from addresses the actors are using.

The alert said investigators have seen the stolen assets converted primarily into ether. The FBI has also attributed a separate $400 million deepfake scheme to North Korean hackers, known publicly under names including APT38 and BlueNoroff. The scheme, called FaceStealer, has resulted in the theft of more than $400 million in cryptocurrency over the last 18 months.

The method is a fake video call. The FBI said North Korean hackers lure targets with meeting invitations sent from accounts stolen from earlier victims. Once a target joins, the hackers play a prerecorded webcam video of a person the target knows, or a deepfake of a well-known figure in the cryptocurrency industry. They then introduce a fake technical error and send a “fix” that installs malware.

In several cases, the theft came months to more than a year after the first compromise, as the hackers waited for wallet balances to grow. A Thursday FBI FLASH report said the meetings run on imposter versions of Zoom, Microsoft Teams and Google Meet. Invitations often move through hijacked Telegram, LinkedIn, Slack or Discord accounts.

Pursuant to a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims. The bureau has posted a hub for the campaign at fbi.gov/facestealer. The seizure of cloud-based infrastructure used in the campaign was announced by the U.S. attorney’s office in the Central District of California and the FBI.