The US Department of Justice has secured court authorization to seize more than $1.2 billion in cryptocurrency stolen during a Binance breach in October. The amount is part of $2.7 billion in stolen funds that government agencies and private-sector partners have frozen, according to DOJ announcements.
The Binance theft, which occurred around October 29, involved more than $6 billion in digital assets. The FBI attributed the attack to TraderTraitor, a hacking operation linked to North Korea's military. Investigators say the group moved the stolen funds through cryptocurrency bridges, mixers, and exchanges to obscure their origins.
The DOJ's latest court action covers a portion of the already-frozen assets and does not represent an additional recovery. US officials said the government is continuing to trace remaining assets and coordinate with virtual asset service providers to prevent further movement of the stolen funds.
Binance previously estimated its losses at approximately $6.3 billion and committed company resources to cover affected assets. The exchange completed that process on November 12 and published an updated proof-of-reserves snapshot.
Separate North Korean Campaign Disrupted
The DOJ also announced the disruption of a separate North Korean cybercrime operation known as FaceStealer, which authorities said resulted in more than $400 million in cryptocurrency theft over the past 18 months.
The operation used compromised accounts, recorded webcam footage, and AI-generated deepfakes to impersonate people familiar to targets. Attackers would send meeting invitations through previously stolen accounts, then play prerecorded footage or deepfake videos to establish trust before instructing victims to install malware.
The campaign extended beyond cryptocurrency investors to include developers maintaining open-source software. By compromising developer accounts or repositories, attackers could potentially introduce malicious code into widely used software, raising concerns about supply-chain attacks.
The FBI seized more than 900 webcam videos belonging to victims as part of the investigation and published guidance to help potential victims identify the scheme.
Coordination and Recovery Efforts
The DOJ described the recovery effort as involving its National Security Division, Criminal Division, the FBI, and other law enforcement partners. Officials emphasized that the actions demonstrate the importance of cooperation between government agencies, exchanges, blockchain analytics firms, and other cryptocurrency service providers.
