US Court Grants DOJ Power to Confiscate $1.2B in North Korea-Linked Binance Stolen Crypto

The Department of Justice announced on Thursday that it has obtained court approval to seize or restrain over $1.2 billion in cryptocurrency that was stolen from Binance. This action is part of a broader freeze exceeding $2.7 billion, which officials stated disrupted roughly half of North Korea's October exchange theft.

According to the department's Thursday statement, members of the North Korean military—identified by the FBI as TraderTraitor—stole more than $6 billion in virtual assets from Binance on or around Oct. 29. That figure is lower than the $6.34 billion that Binance has since covered following the attack.

Binance announced that it had fully reimbursed the assets affected by the breach, replacing the tokens from its own funds rather than through recovery of the stolen coins. These are separate processes: the DOJ is working to intercept the stolen funds, while the exchange stated it made users whole via its Secure Asset Fund for Users, along with portions of its futures insurance fund and treasury.

Assistant Attorney General A. Tysen Duva of the DOJ's Criminal Division stated that the department and its collaborators managed to "immediately halt about half of this historic breach" by freezing stolen assets "before they got beyond law enforcement reach." The freeze exceeding $2.7 billion represents a combined effort from the U.S. government and the private sector. Within that amount, the DOJ has already secured court authorization to seize or restrain more than $1.2 billion. The court documents were not released alongside the announcement.

The $1.2 billion does not represent newly recovered funds but is part of the roughly $2.85 billion that Binance reported on Nov. 3 as frozen or intercepted. Thursday's court authorization is the legal step enabling the government to pursue ownership of those funds via forfeiture, whereas previously they had only been frozen at the token issuers.

The freeze does not mark the end of the operation. The DOJ noted that TraderTraitor actors continue to move the stolen assets through cryptocurrency bridges, mixers, and exchanges, and that tracing, seizure, and forfeiture efforts remain ongoing. Last week, on Oct. 31, the FBI, together with the U.S. Secret Service and IRS Criminal Investigation, released a Cyber Alert attributing the theft to North Korea and urging virtual asset service providers to block transactions involving addresses used by the actors. The alert indicated that investigators observed the stolen assets being converted primarily into ether.

A separate $400 million deepfake scheme, and 900 seized videos

In a separate matter from the DOJ and Binance case, the U.S. attorney's office in the Central District of California and the FBI announced the seizure of cloud-based infrastructure used in a social engineering campaign dubbed FaceStealer by the FBI. The FBI reported that the scheme has led to the theft of more than $400 million in cryptocurrency over the past 18 months and has also been used in attempts to compromise individuals maintaining open-source software, a move the bureau described as likely intended to enable supply-chain attacks.

The method involves a fake video call. The FBI stated that North Korean hackers, known publicly as APT38 and BlueNoroff, lure targets with meeting invitations sent from accounts stolen from earlier victims. Once a target joins, the hackers play a prerecorded webcam video of someone the target knows, or a deepfake of a well-known figure in the cryptocurrency industry, then introduce a fake technical error and send a "fix" that installs malware. In several instances, the theft occurred months to over a year after the initial compromise, as the hackers waited for wallet balances to increase.

A Thursday FBI FLASH report indicated that the meetings run on imposter versions of Zoom, Microsoft Teams, and Google Meet, with invitations often moving through hijacked Telegram, LinkedIn, Slack, or Discord accounts. Pursuant to a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims. The bureau has posted a hub for the campaign at fbi.gov/facestealer.

Principal Deputy Assistant Attorney General for National Security M. Scott Proctor linked both Thursday's actions to the same charge: "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft."

The Binance recovery continues to be managed by the FBI's Los Angeles Field Office, Cyber Division, and Virtual Asset Unit, along with the Secret Service and IRS-CI. The DOJ did not disclose how much of the more than $2.7 billion freeze, or of the $1.2 billion under court authority, consists of bitcoin.