DOJ Secures Court Authority Over $1.2B of Binance Hack Proceeds Tied to North Korea
The Justice Department said Thursday it obtained court authorization to seize or restrain more than $1.2 billion of cryptocurrency stolen from Binance in October, out of a broader $2.7 billion freeze. The attack, attributed by the FBI to North Korean actors, is one of the largest exchange thefts on record, and recovery work is ongoing.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
The Court Authorization and the Freeze
The Department of Justice said Thursday it has court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, within a freeze the department puts at more than $2.7 billion. Assistant Attorney General A. Tysen Duva of the Criminal Division said the department and its partners had halted "about half of this historic breach" by freezing assets before they moved beyond law enforcement reach.
The $2.7 billion figure is a joint total covering U.S. government and private-sector efforts. The court papers supporting the $1.2 billion authorization were not posted with the announcement, so the basis for the figure can only be taken from the DOJ's statement.
How the Numbers Line Up
The sources differ on the size of the theft itself, and the gap is worth tracking. The DOJ said the North Korean military group the FBI calls TraderTraitor stole more than $6 billion in virtual assets on or about Oct. 29. Binance has said it has covered $6.34 billion in losses since the attack. Those figures are not contradictory, since the exchange's coverage includes amounts beyond the stolen principal, but the two sources do not reconcile them directly.
The $1.2 billion is also not newly recovered money. It is drawn from roughly $2.85 billion that Binance said on Nov. 3 had been frozen or intercepted. What Thursday's authorization changes is the legal path: assets that had been frozen at token issuers can now move toward government ownership through forfeiture. Recovery and reimbursement are separate tracks. Binance has said users were made whole through its Secure Asset Fund for Users, a portion of its futures insurance fund and its treasury, rather than through recovered coins.
Ongoing Movement and the FBI Alert
The DOJ said the attackers are still moving funds through cryptocurrency bridges, mixers and exchanges, and that tracing, seizure and forfeiture work continues. On Oct. 31 the FBI, together with the U.S. Secret Service and IRS Criminal Investigation, issued a Cyber Alert attributing the theft to North Korea. The alert said the stolen assets had been converted primarily into ether and urged virtual asset service providers to block transactions with or derived from addresses the actors were using.
A Separate Campaign: FaceStealer
In a related but distinct action, the U.S. Attorney's Office for the Central District of California and the FBI announced the seizure of cloud infrastructure used in a social engineering campaign the FBI calls FaceStealer. The bureau said the scheme has stolen more than $400 million in cryptocurrency over the past 18 months and has also targeted open-source software maintainers, a step it said appears designed to enable supply-chain attacks.
The FBI describes the method as fake video calls. Targets receive meeting invitations from accounts previously compromised, join a call on imitation versions of Zoom, Microsoft Teams or Google Meet, and are shown a prerecorded video of a known contact or a deepfake of a prominent crypto figure. A fabricated technical error then leads to a "fix" that installs malware. In several cases the theft came more than a year after the first compromise. Under a federal warrant the FBI seized more than 900 webcam videos of victims, and it has published a campaign hub at fbi.gov/facestealer. The FBI attributes the campaign to North Korean actors known publicly as APT38 and BlueNoroff.
Why It Matters
For Traders
Ether-denominated flows and the ongoing bridge and mixer movements mean exchange-level blocklist activity could shift liquidity and monitoring conditions over the next few days.
For Investors
Forfeiture of frozen assets and the scale of the North Korean operation signal sustained enforcement pressure on state-linked crypto theft, not a one-off recovery.
For Builders
The FaceStealer method targets developers and maintainers through fake meeting tools, so wallet, repository and call-software hygiene now matters as much as smart contract security.
This article is for information only and is not financial advice. Read the full disclaimer.
