DOJ Secures Court Approval to Seize $1.2 Billion From Binance Hack, Targets North Korean Hackers

Summary

• The DOJ secured court approval to seize over $1.2 billion linked to Binance’s massive cryptocurrency hack by North Korean hackers.
• Binance allocated $6.34 billion to cover affected assets as authorities and private companies froze over $2.7 billion in cryptocurrency.
• Federal agents dismantled FaceStealer infrastructure linked to $400 million in theft and seized over 900 webcam recordings from victims.

The U.S. Department of Justice has secured court approval to seize or restrain over $1.2 billion linked to Binance’s massive cryptocurrency hack. The action targets stolen assets connected to North Korean hackers responsible for one of the industry’s largest security breaches.

According to a Thursday announcement from the DOJ, authorities and private companies have frozen more than $2.7 billion in stolen cryptocurrency. Investigators are also tracking additional funds moving through blockchain bridges, cryptocurrency mixers, and exchanges.

DOJ Targets $6 Billion Binance Hack as Asset Recovery Expands

Federal investigators linked the October 29 Binance attack to TraderTraitor, a hacking group associated with North Korea’s military intelligence operations. The DOJ estimates that the group stole more than $6 billion during the security breach.

Binance previously estimated its losses at approximately $6.3 billion and allocated $6.34 billion in company funds to cover affected assets. The exchange also confirmed that it had completed coverage of impacted customer holdings and released an updated proof-of-reserves. Meanwhile, federal authorities have expanded their efforts to recover stolen cryptocurrency and prevent further movement of compromised funds.

Principal Deputy Assistant Attorney General M. Scott Proctor accused North Korea of financing its government and weapons programs through cryptocurrency theft. Proctor emphasized that the National Security Division would pursue stolen assets and seek their return.

Significantly, the court authorization covers more than $1.2 billion, while the broader freezing efforts involve over $2.7 billion. Investigators have not disclosed a complete recovery timeline as blockchain tracing operations remain underway.

DOJ Dismantles North Korean FaceStealer Infrastructure Linked to $400 Million Theft

Beyond the Binance investigation, federal authorities seized cloud infrastructure supporting another North Korean cryptocurrency theft operation known as FaceStealer. The FBI estimates that the campaign generated more than $400 million in cryptocurrency losses over the past 18 months.

Attackers gained control of communication accounts and used them to arrange fraudulent video meetings with unsuspecting victims. During these calls, criminals impersonated familiar contacts through prerecorded footage and artificial intelligence-generated deepfakes.

They subsequently introduced fabricated technical problems and persuaded victims to install malicious software capable of compromising cryptocurrency wallets and computer systems. Patrick Grandy, assistant director of the FBI’s Los Angeles Field Office, warned that the scheme exploited trusted relationships and video conferencing platforms.

Investigators discovered that some attackers waited months or longer than a year before exploiting previously compromised computers. Additionally, hackers used stolen contact information to identify more targets, including open-source developers whose software could expose additional users.

Federal agents seized more than 900 webcam recordings associated with FaceStealer victims and issued guidance to affected individuals.

Conclusion

The DOJ’s coordinated actions target two North Korean cryptocurrency theft operations involving billions of dollars in losses. Authorities have secured substantial asset restrictions while dismantling infrastructure supporting fraudulent video calls and malware distribution.