U.S. authorities have obtained court approval to seize or restrain more than $1.2 billion stolen in a Binance hack. The Justice Department announced the action on November 12, two weeks after the exchange reported the theft. The amount forms part of more than $2.7 billion frozen through government and private-sector efforts.
The FBI attributed the attack to North Korean hackers, while Binance estimated the total loss at $6.34 billion. The hack occurred on October 29 and affected several cryptocurrencies held by the exchange. North Korea has denied involvement in the theft.
Tracing Stolen Assets
Freezing assets prevents them from being moved, while court-authorized seizure or restraint represents another step in the legal process. However, neither figure means all stolen cryptocurrency has been recovered or returned.
Investigators are still tracing assets as hackers move funds through exchanges, mixers, and bridges. Bridges transfer assets between blockchains, while mixers can obscure transaction histories. The FBI observed attackers converting stolen assets primarily into Ether and urged crypto service providers to block transactions linked to identified addresses.
Binance said attackers accessed an internal wallet-signing service and initiated transfers outside its normal withdrawal process. The exchange said independent security firms would provide further reviews following the attack. On November 12, Binance announced it had completed coverage of affected assets using company resources and published a new reserve snapshot.
Separate Enforcement Action Against FaceStealer
Authorities announced a separate enforcement action against FaceStealer, a fake video-call scheme that stole more than $400 million in cryptocurrency over the past 18 months. The FBI seized cloud infrastructure linked to the campaign, which the Justice Department said was operated by North Korean hackers.
FaceStealer targeted people working in cryptocurrency and Web3, as well as developers who maintain open-source software. The scheme began with compromised messaging accounts belonging to earlier victims. Hackers used those accounts to invite contacts to video meetings on sites resembling Zoom or Microsoft Teams.
Once inside the meetings, targets saw recordings of people they recognized. Attackers also used artificial intelligence-generated videos of well-known figures in the crypto industry in some cases. The hackers then claimed there was a technical problem and supplied a link or instructions for a supposed fix that instead installed malware.
Under federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims. Investigators said attackers could reuse recordings from one victim to impersonate that person in later meetings. The FBI warned that access to a developer's device or software accounts could enable attacks on widely used applications.
