DOJ obtains court approval to seize $1.2 billion in North Korea’s stolen Binance crypto

The US Department of Justice (DOJ) has received court authorization to seize or restrain over $1.2 billion in cryptocurrency allegedly stolen from Binance by North Korean operatives. This move is part of a broader effort that has resulted in the freezing of more than $2.7 billion in digital assets connected to a significant October cyberattack on the global exchange.

Scale of the Binance breach and DOJ’s intervention

The DOJ reported that, on or around October 29, individuals associated with the North Korean military infiltrated Binance and stole over $6 billion in virtual assets. The FBI refers to the hacking group involved as TraderTraitor. This figure is slightly lower than the $6.34 billion that Binance claims to have covered for affected users after the attack.

Binance, the world’s largest cryptocurrency exchange by trading volume, stated it compensated users fully by replenishing lost assets with company funds. These replacements were drawn from Binance’s Secure Asset Fund for Users (SAFU), a portion of its futures insurance fund, and the firm’s treasury, rather than recovering the stolen coins directly.

The DOJ, meanwhile, has focused on tracking and intercepting the stolen assets. Of the overall $2.7 billion that has been frozen or intercepted, the department received court approval on Thursday for the potential seizure or further restraint of $1.2 billion. These steps were described on Thursday by Assistant Attorney General A. Tysen Duva as crucial in “immediately halt[ing] about half of this historic breach,” allowing authorities to freeze the assets before they could be laundered beyond law enforcement’s reach.

Assistant Attorney General A. Tysen Duva emphasized that joint efforts between the DOJ and its partners enabled them to rapidly freeze around half of the stolen assets from the Binance breach, stopping the funds before they left the legal reach of law enforcement.

Court authorization enables the government to initiate forfeiture procedures, which may convert the previously frozen digital assets into government property. According to Binance, approximately $2.85 billion had already been frozen or recovered as of early November, with Thursday’s announcement marking a formal legal step in the process.

Ongoing investigations and asset movement

The DOJ noted that North Korean-linked actors continue to move the remaining stolen funds through cryptocurrency bridges, mixers, and exchanges. Work to trace, seize, and forfeit these assets is ongoing. On October 31, the FBI, IRS Criminal Investigation, and the US Secret Service issued a Cyber Alert, attributing responsibility for the attack to North Korea and recommending that virtual asset service providers block transactions associated with addresses linked to the North Korean hackers. Investigators have observed that a large portion of the laundered assets has been converted into ether.

The investigation is being coordinated primarily through the FBI’s Los Angeles Field Office, Cyber Division, and Virtual Asset Unit, with support from the Secret Service and IRS-CI. The DOJ has not specified what portion of the seized or frozen funds is comprised of bitcoin.

Mini dictionary: TraderTraitor — a hacking group linked to the North Korean military, known for cyberattacks targeting the cryptocurrency sector, and attributed by US law enforcement to significant exchange breaches.

FaceStealer: Deepfake-driven theft targeting crypto assets

Separately, the US Attorney’s Office for the Central District of California and the FBI announced the seizure of infrastructure connected to FaceStealer, a social engineering campaign that exploited video deepfakes. The FBI estimates that the operation led to the theft of over $400 million in cryptocurrency during the past 18 months.

Hackers, using aliases such as APT38 and BlueNoroff, targeted individuals responsible for open-source software and lured victims into fake video calls. The attackers would invite targets to meetings via accounts hijacked from previous victims, then play prerecorded videos or deepfakes of industry figures. They would introduce a fake technical glitch, prompting the victim to download supposed fixes that actually installed malware. In many cases, hackers waited several months or longer to steal funds after the initial system compromise.

The FBI detailed how FaceStealer actors used imposter versions of familiar video conferencing platforms, sending meeting invitations via hijacked Telegram, LinkedIn, Slack, or Discord accounts. The bureau seized over 900 webcam videos used in the campaign and published further information about FaceStealer on a dedicated law enforcement portal.

Principal Deputy Assistant Attorney General for National Security M. Scott Proctor attributed both enforcement actions to North Korea’s efforts to fund its regime and weapons program through illicit cryptocurrency activity.