DOJ moves to seize $1.2bn of $6.36bn Binance theft it blames on North Korea

The US Justice Department said it has obtained court authorisation to seize or restrain more than $1.2bn in crypto stolen from Binance, a virtual currency exchange, which it attributes to North Korean military hackers the FBI calls "TraderTraitor" (DOJ release). That ranks first of four distinct seized figures stated in US hack or theft enforcement actions since January 2024, and it comes from a single theft that took $6.36bn on October 29.

The department puts the Binance theft at "more than $6 billion". It says US government and private-sector efforts have frozen more than $2.7bn so far. The $1.2bn under court order is part of that frozen amount, not in addition to it. Assistant Attorney General A. Tysen Duva said the Criminal Division acted to "immediately halt about half of this historic breach."

The rest is still moving. According to the release, TraderTraitor actors "continue to launder such assets through various cryptocurrency bridges, mixers, and exchanges". The department says efforts to trace, freeze, seize and forfeit them are ongoing. Last week the FBI, the Secret Service and IRS Criminal Investigation issued a Cyber Alert attributing the theft. It urged virtual asset service providers to block transactions involving addresses the hackers are using to launder the funds. Whether any of the restrained funds will be returned to Binance or its users is not yet known.

FaceStealer infrastructure seized

Separately, the US Attorney's Office for the Central District of California announced the seizure of cloud infrastructure used in a social engineering scheme the FBI has named FaceStealer. The FBI says the scheme has stolen more than $400m in the last 18 months. It attributes the scheme to North Korean groups known publicly as Sapphire Sleet, APT38 and BlueNoroff, among other names.

According to the release, targets are invited to video meetings from accounts stolen from earlier victims. The hackers play prerecorded footage of those victims, or deepfakes of well-known industry figures, to win the target's trust. They then fake a technical error and supply a supposed fix that installs malware. In several reported cases, theft came months to more than a year after the first compromise. The department says the scheme is increasingly aimed at people who develop and maintain open-source software, and that this targeting appears designed to enable attacks on the software supply chain. Under a federal warrant, the FBI seized over 900 webcam videos of victims.

The release announces no criminal charges against any individual in either matter.

From the archive

• North Korean Scammers Using DeFi Platforms to Launder Money
• SEC’s Lawsuit Triggers Dissolution Actions From Grayscale

Sources

1. DOJ: Justice Department Announces Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency
2. Bitminer.io enforcement ledger

By The Assayer, the Bitminer.io house byline. Written by AI from the sources above and checked automatically. No person reviewed it before publication. How we work.

Every crypto theft the US attributes to North Korea

Binance’s record: licences, hacks and US cases

More on Binance, North Korea