DOJ Secures Court Order to Freeze $1.2 Billion in North Korean Crypto After Binance Heist

The Department of Justice announced Thursday that it has obtained court authority to seize or restrain over $1.2 billion in cryptocurrency stolen from Binance, which is part of a broader $2.7 billion freeze that officials estimate halted roughly half of North Korea’s October exchange heist.

In a Thursday announcement, the department revealed that on or about October 29, members of the North Korean military—identified by the FBI as “TraderTraitor”—stole more than $6 billion in virtual assets from Binance, falling short of the $6.34 billion figure Binance later covered due to the breach.

Binance confirmed it had fully covered the compromised assets by replenishing token balances from company funds rather than by retrieving the stolen coins. These represent distinct efforts: the DOJ is working to interdicted the stolen assets, while the exchange asserts that users were restored through its Secure Asset Fund for Users, a segment of its futures insurance fund, and its treasury.

Assistant Attorney General A. Tysen Duva of the DOJ’s Criminal Division stated that the department and its partners successfully “immediately halted about half of this historic breach” by freezing stolen assets before they could evade law enforcement. The $2.7 billion freeze encompasses collaboration between U.S. government agencies and private sector entities. The DOJ has already secured court authorization to seize or restrain over $1.2 billion of those assets, though the specific court documents were not included with the release.

The $1.2 billion figure represents not newly recovered funds but rather draws from the approximately $2.85 billion Binance reported had been frozen or intercepted on November 3. Thursday’s court authorization provides the legal basis for the government to pursue forfeiture, transitioning these assets from frozen token issuers toward government seizure.

Even that freeze does not mark the conclusion of the investigation. The DOJ noted that TraderTraitor operatives continue moving stolen assets via cryptocurrency bridges, mixers, and exchanges, with forensic tracing and seizure efforts ongoing. On October 31, the FBI, in coordination with the U.S. Secret Service and IRS Criminal Investigation, issued a Cyber Alert linking the heist to North Korean actors and warning virtual asset service providers to block transactions originating from their addresses. The alert referenced investigations revealing the illicit proceeds were predominantly converted to ether.

A separate $400 million deepfake scheme, and 900 seized videos

Independently of the DOJ and Binance investigation, the U.S. attorney’s office in the Central District of California and the FBI disclosed the seizure of cloud-based infrastructure tied to a social engineering operation dubbed “FaceStealer.” The campaign has facilitated over $400 million in cryptocurrency thefts over the past 18 months and has also been employed to compromise individuals maintaining open‑source software, a move the bureau indicates aims to facilitate supply‑chain attacks.

The attack vector involves deceptive video calls. The FBI reported that North Korean hackers, operating under identities such as APT38 and BlueNoroff, impersonate individuals by sending meeting invitations from compromised accounts. Once a victim joins, the adversaries play a pre‑recorded webcam clip of a trusted contact or a deepfake of a prominent cryptocurrency figure, then introduce a fabricated technical issue and deliver a “fix” that installs malware. In many incidents, illicit fund transfers occurred months or even over a year after the initial breach, as the operators allowed wallets to accumulate sufficient value.

A Thursday FBI FLASH bulletin noted that the meetings were conducted on spoofed versions of Zoom, Microsoft Teams, and Google Meet, with invitations frequently relayed through compromised Telegram, LinkedIn, Slack, or Discord accounts. Executing a federal warrant, the FBI obtained more than 900 webcam recordings of FaceStealer victims. The agency maintains a dedicated hub for the campaign at fbi.gov/facestealer.

Principal Deputy Assistant Attorney General for National Security M. Scott Proctor linked Thursday’s actions to the same charge: “North Korea’s government finances its rogue regime and illicit weapons agenda through cryptocurrency theft.”

The Binance recovery remains the focus of the FBI’s Los Angeles Field Office, Cyber Division, and Virtual Asset Unit, in coordination with the Secret Service and IRS‑CI. The Department of Justice declined to specify the composition of the $2.7 billion freeze or the $1.2 billion authorized for forfeiture, including any portion that would be Bitcoin.

Source link