Key takeaways
- DOJ secures court authorization over $1.2 billion in crypto
- Binance hack recovery freezes reach more than $2.7 billion
- FBI disrupts separate $400 million North Korean deepfake scheme
The US Department of Justice has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen during Binance's record $6.3 billion security breach, marking a major development in the investigation into North Korean cybercrime.
According to the DOJ's November 12 announcement, authorities and private-sector partners have frozen more than $2.7 billion of the stolen assets, approximately 43% of the total theft.
The operation follows the October 29 Binance security breach, which investigators attributed to North Korean military-linked hackers known as TraderTraitor. The stolen funds are still being traced as attackers attempt to move cryptocurrency through exchanges, bridges and mixing services.
DOJ Freezes Billions as Binance Hack Recovery Advances
The FBI identified TraderTraitor as responsible for stealing more than $6 billion in digital assets from Binance, the largest cryptocurrency exchange theft reported to date.
The attack began with approximately $296 million in XRP transfers following an estimated 36-hour preparation period, according to earlier blockchain forensic findings.
Attackers subsequently moved Bitcoin, Ethereum, stablecoins and other cryptocurrencies across multiple networks, complicating recovery efforts.
US authorities worked with cryptocurrency service providers to identify and restrict the stolen assets before they could be fully laundered.
However, freezing cryptocurrency is not equivalent to returning it. The $1.2 billion under court authorization forms part of the $2.7 billion already frozen, and ownership and forfeiture proceedings remain unresolved.
Investigators are continuing to monitor suspicious transactions, including movements linked to earlier $101 million XRP transfers.
The investigation has also exposed unconventional laundering methods. North Korean operators reportedly used fake memecoin trading to disguise approximately $430,000 in stolen cryptocurrency.
FBI Disrupts North Korea's $400M Deepfake Crypto Scheme
Separately, the FBI disrupted a North Korean social-engineering campaign called FaceStealer, which authorities say has stolen more than $400 million in cryptocurrency over 18 months.
The operation involved attackers hijacking messaging accounts, impersonating trusted contacts and arranging fraudulent video meetings.
Hackers used prerecorded footage and AI-generated deepfakes to convince victims they were speaking with familiar people. They then simulated technical problems and directed victims to install malicious software.
Once installed, the malware could compromise cryptocurrency wallets, communications accounts and developer infrastructure.
The FBI seized more than 900 webcam recordings linked to the operation, while investigators also identified attempts to compromise open-source software developers.
The campaign reflects a broader evolution in North Korean AI-assisted phishing, where attackers increasingly combine familiar identities with malicious software.
What Happens to Binance's Stolen Cryptocurrency?
Binance has separately worked to restore customer asset backing using corporate funds, its insurance resources and the Secure Asset Fund for Users.
The exchange previously announced substantial reserve replenishment, while its November 4 update reported that approximately 98% of affected assets had been replaced.
That process is distinct from the government's recovery operation. Binance can replenish customer balances without investigators having recovered the originally stolen cryptocurrency.
The DOJ's latest action strengthens legal control over a substantial portion of the stolen funds, but it does not establish that victims have received the $1.2 billion.
