DOJ Wins Court Approval to Seize $1.2 Billion Linked to Binance Hack and North Korean Hackers
The U.S. Department of Justice has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency connected to the October Binance hack, as federal investigators intensify efforts to recover assets allegedly stolen by North Korean hackers.
According to In an announcement on Thursday, the DOJ said authorities and private-sector partners have frozen more than $2.7 billion in stolen cryptocurrency. Investigators are continuing to trace additional funds moving through blockchain bridges, cryptocurrency mixers and exchanges, where stolen assets may be transferred or concealed.
DOJ Pursues Assets Linked to Binance's $6 Billion Hack
Federal investigators attributed the October 29 attack on Binance to TraderTraitor, a hacking group associated with North Korea's military intelligence operations. The DOJ estimates that the group stole more than $6 billion during the breach.
Binance previously put its losses at approximately $6.3 billion and said it allocated $6.34 billion in company funds to cover affected assets. The exchange also confirmed that it had completed coverage of impacted customer holdings and published an updated proof-of-reserves.
The court-approved action covering more than $1.2 billion is part of a broader effort to restrict the movement of stolen cryptocurrency. The separate figure of more than $2.7 billion represents assets frozen through the wider recovery effort, rather than the amount covered by the latest court authorization.
Principal Deputy Assistant Attorney General M. Scott Proctor accused North Korea of using cryptocurrency theft to finance its government and weapons programs. He said the DOJ's National Security Division would continue pursuing stolen assets and seeking their return.
Authorities have not provided a complete timeline for recovering the funds. Blockchain tracing operations remain underway as investigators follow additional transactions across different services and networks.
FBI Seizes Infrastructure Behind North Korean FaceStealer Operation
The DOJ also announced action against a separate North Korean-linked cryptocurrency theft campaign known as FaceStealer. Federal authorities seized cloud infrastructure allegedly supporting the operation, which the FBI estimates caused more than $400 million in cryptocurrency losses over the past 18 months.
According to investigators, the attackers compromised communication accounts and used them to arrange fraudulent video meetings with potential victims. They impersonated people familiar to their targets through prerecorded footage and artificial intelligence-generated deepfakes.
During the calls, criminals introduced fabricated technical issues and persuaded victims to install malicious software. The software could then compromise cryptocurrency wallets and computer systems, giving attackers access to digital assets and other information.
Patrick Grandy, assistant director of the FBI's Los Angeles Field Office, warned that the scheme exploited trusted relationships and widely used video conferencing platforms.
Hackers Delayed Exploitation of Compromised Computers
Investigators found that some attackers waited months, or even longer than a year, before exploiting computers they had previously compromised. The campaign also involved the use of stolen contact information to identify additional targets.
Among those targeted were open-source developers whose software could provide attackers with access to a wider group of users. The findings highlight how an initial compromise could be used to facilitate further attacks long after the original intrusion.
Federal agents seized more than 900 webcam recordings associated with FaceStealer victims and issued guidance to affected individuals.
The two cases demonstrate the scope of the DOJ's efforts against cryptocurrency theft operations linked to North Korea. While authorities have secured restrictions on billions of dollars in suspected stolen assets, investigations into the Binance breach and FaceStealer campaign remain ongoing.
Writer: Marcus RenfieldCrypto Market Analyst & Onchain WriterMarcus Renfield covers cryptocurrency markets with a focus on onchain data, Bitcoin price action, and emerging market narratives. His writing examines how capital flows, network activity, and broader market structure influence short- and medium-term trends.He aims to provide clear, data-informed analysis for readers seeking a deeper understanding of crypto market dynamics.