The Department of Justice announced Thursday that it has obtained court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, marking a significant step in recovering assets from what officials described as a historic breach.
According to the DOJ, members of the North Korean military, identified by the FBI as TraderTraitor, stole more than $6 billion worth of virtual assets from Binance on or about October 29. The department and its partners froze more than $2.7 billion in stolen assets, halting approximately half of the breach before the funds could move beyond law enforcement reach.
The $1.2 billion now under court authorization for seizure or restraint represents assets previously frozen at token issuers. The court order enables the government to proceed toward taking ownership of these funds through forfeiture proceedings. Binance has said it compensated affected users from its Secure Asset Fund for Users, portions of its futures insurance fund, and its treasury, completing coverage of the assets targeted in the attack.
The DOJ noted that actors associated with TraderTraitor continue moving stolen assets through cryptocurrency bridges, mixers, and exchanges. Investigators have observed the stolen assets being converted primarily into ether. Tracing, seizure, and forfeiture work remains ongoing.
In a separate action, the U.S. Attorney's Office in the Central District of California and the FBI announced the seizure of cloud-based infrastructure used in a social engineering campaign known as FaceStealer. The FBI attributed the scheme to North Korean hackers also known as APT38 and BlueNoroff, reporting that it has resulted in the theft of more than $400 million in cryptocurrency over the past 18 months.
The FaceStealer scheme uses fake video calls conducted on imposter versions of Zoom, Microsoft Teams, and Google Meet. Hackers send meeting invitations from stolen accounts and play prerecorded or deepfake videos of known contacts or cryptocurrency industry figures before introducing a fake technical error and distributing malware. The FBI seized more than 900 webcam videos from victims and established an informational hub at fbi.gov/facestealer.
The Principal Deputy Assistant Attorney General for National Security stated that both actions address how North Korea funds its government and weapons programs through cryptocurrency theft.
