The U.S. Department of Justice announced on November 12 that it had obtained court authorization to seize or restrain stolen Binance assets worth more than $1.2 billion. These funds were part of more than $2.7 billion frozen through coordinated government and private-sector efforts following a theft the DOJ attributed to North Korean military hackers around October 29.
The theft exceeded $6 billion according to U.S. authorities. Principal Deputy Assistant Attorney General for National Security M. Scott Proctor stated that the National Security Division would use every tool at its disposal to seize and return what he characterized as North Korea's ill-gotten gains. The department linked the cryptocurrency thefts to financing the North Korean government and its illicit weapons program.
Exchange Response and Asset Coverage
Binance announced on November 12 that it had completed coverage of affected assets after committing more than $6.34 billion in company funds to cover the losses. The exchange published a reserve snapshot covering 198 tokens, capturing balances at midnight UTC on that date.
Laundering Operation Complexity
Blockchain analytics firm Elliptic identified a complex laundering network involving nearly 27,000 wallets across at least 16 blockchains, at least 36 services, and more than 83,000 transactions. The firm tracked conversions of stolen solana, XRP, and tron into bitcoin, and identified meme coins used to disguise theft proceeds on multiple blockchains.
According to Elliptic's analysis covering November 11-13, converted proceeds had reached roughly 4,100 bitcoin, valued at approximately $285 million at the time. The firm estimated roughly 11,000 ether in laundering-linked deposits into Tornado Cash.
Ongoing Investigation
The Federal Bureau of Investigation attributed the Binance theft to Tradertraitor, its designation for North Korean hacking activity. Working with the U.S. Secret Service and IRS Criminal Investigation, the FBI observed attackers converting stolen assets primarily into ether and expected further laundering through decentralized finance and instant-swap services.
Investigators continued pursuing funds moving through blockchain bridges, mixers, and exchanges. Authorities urged digital asset businesses to block transactions involving or derived from identified addresses. North Korea denied responsibility for the attack on November 3 through a statement by Kim Yo-jong, carried by state media.
