US authorities have received court approval to seize or restrain more than $1.2 billion in cryptocurrency linked to the Binance hack. The Department of Justice disclosed this action on November 12, two weeks after Binance originally reported the theft, bringing the total amount frozen by public and private initiatives to over $2.7 billion.
FBI links Binance hack to North Korean attackers
The Federal Bureau of Investigation has attributed the Binance breach to TraderTraitor, a cybercriminal group with ties to the government of North Korea. According to Binance, the attack—which took place on October 29—resulted in total estimated losses of $6.34 billion across various digital assets held by the exchange.
North Korean officials have publicly denied involvement in the incident. However, US officials maintain that cryptocurrency theft is a significant funding source for North Korea’s government operations and weapons development programs.
The $1.2 billion sum authorized by court orders forms part of the $2.7 billion already frozen and does not represent an additional amount, as clarified by the Justice Department.
Authorities say freezing assets can prevent further movement, while court-authorized seizures represent a subsequent legal measure. Both steps are part of efforts to limit criminals’ access to stolen assets, but neither guarantees that all funds will be recovered or returned to victims.
Ongoing investigations have highlighted that the stolen assets continue to be transferred via exchanges, cryptocurrency mixers, and bridges. Mixers are tools that obscure transaction histories to conceal the origin and destination of funds, while bridges allow assets to be moved between different blockchain networks.
Following the attack, the FBI noted that stolen assets were primarily converted into Ether. The agency requested that cryptocurrency service providers block addresses associated with the attackers to impede illicit transfers.
Binance reported that the attackers compromised its internal wallet-signing services, circumventing normal withdrawal protocols and initiating unauthorized transfers. Further examination revealed a sophisticated operation involving fictitious job interviews, malware deployment, and exploitation of company systems. Binance indicated that independent security reviews would be conducted to assess the full scope of the breach.
On November 12, Binance stated that it had replaced the affected assets with company reserves and published an updated reserve snapshot. The firm added that cryptographic proof of the new reserves would be released later. However, replacing stolen funds internally does not mean all the hacked cryptocurrency has been recovered.
| Metric | Binance Hack |
|---|---|
| Total estimated loss | $6.34 billion |
| Assets frozen | $2.7 billion |
| Assets under court order | $1.2 billion |
Binance detailed that attackers exploited an internal wallet-signing service and initiated a series of transfers that bypassed the normal withdrawal processes, describing the operation as multi-stage and highly sophisticated.
US seizes FaceStealer infrastructure in separate action
In a separate enforcement effort, the Department of Justice announced the seizure of infrastructure connected to FaceStealer, a cyber operation also attributed to North Korean groups. This campaign targeted professionals in the cryptocurrency and Web3 sectors.
Investigators reported that FaceStealer compromised messaging accounts of prior victims, sending invitations for video meetings on platforms mimicking legitimate services like Zoom or Microsoft Teams. Once victims joined these sessions, they encountered video loops of contacts they knew or, in some cases, AI-generated videos of prominent crypto industry figures.
Attackers often claimed technical difficulties during the calls, providing links or instructions that would secretly install malware on victims’ devices. This malicious software enabled theft of cryptocurrency and other sensitive information.
By taking over accounts, attackers gained access to further contacts and historical conversations, making their outreach appear credible.
Based on a federal warrant, the FBI seized more than 900 webcam videos connected to FaceStealer. Officials warn that attackers can use these recordings to impersonate victims in future schemes, enhancing their social engineering tactics.
Mini dictionary: FaceStealer, a malicious campaign linked to North Korean actors, uses fraudulent video call infrastructure to gain access to victims’ credentials and cryptocurrency, often employing deepfakes or recycled videos to enhance credibility during attacks.
Federal investigators further warned that compromising a software developer’s device or account could put numerous users of widely distributed applications at risk, due to the potential for broader supply-chain attacks.
FaceStealer exploited familiar contacts and AI technology to create believable fake meetings, encouraging victims to install malware that could drain crypto assets and open the door to larger breaches across the sector.
