TheBlock
The U.S. Department of Justice has obtained court approval to seize or restrain more than $1.2 billion stolen from Binance, part of a broader effort that has frozen over $2.7 billion in assets through combined actions by U.S. authorities and private companies. The DOJ attributed the exchange hack to TraderTraitor, North Korean military hackers it says stole more than $6 billion around Oct. 29. Binance had previously pegged its losses at about $6.3 billion and set aside $6.34 billion to cover them, and on Thursday said it completed coverage of impacted assets while publishing a new proof of reserves snapshot.
Why it matters
The seizure marks one of the largest recoveries ever pursued against North Korean crypto theft, which the DOJ says bankrolls the regime and its weapons program. Investigators are still tracing stolen funds as hackers move them through crypto bridges, mixers and exchanges, so the $1.2 billion figure may grow.
Separately, the DOJ seized cloud infrastructure behind FaceStealer, an FBI-designated North Korean campaign that has drained more than $400 million in crypto over 18 months. The scheme lured victims into video calls playing deepfakes of familiar people, then tricked them into installing crypto-stealing malware. The FBI seized more than 900 victim webcam videos and issued guidance, warning that the takeover of communication accounts sometimes surfaced months after the initial compromise, with open-source software developers also targeted.
Market impact
For Binance, the DOJ action and the completed coverage of impacted assets remove a major overhang, and the fresh proof of reserves publication gives users a verifiable look at the balance sheet. Larger exchanges with institutional custody mandates will read the recovery as evidence that law enforcement can claw back state-sponsored theft, a structural positive for the regulated custody sector.
The FaceStealer seizure is a warning shot for anyone operating in crypto: verify video-call identities out of band, and treat unexpected software installs on a familiar face's call as hostile until proven otherwise.
Frequently asked questions
-
How much of the Binance hack proceeds is the DOJ trying to seize?
The DOJ obtained court approval to seize or restrain more than $1.2 billion stolen from Binance, as part of a broader effort that has frozen more than $2.7 billion through U.S. authorities and private companies.
-
Who was behind the Binance hack according to investigators?
The DOJ attributed the hack to TraderTraitor, North Korean military hackers who it says stole more than $6 billion from the exchange around Oct. 29.
-
How did Binance respond to the hack losses?
Binance previously estimated losses at about $6.3 billion and set aside $6.34 billion in company funds to cover them. It has since completed coverage of impacted assets and published a new proof of reserves snapshot.
-
What is the FaceStealer deepfake scheme the DOJ disrupted?
FaceStealer is an FBI-designated North Korean campaign responsible for more than $400 million in crypto theft over 18 months. Hackers invited victims to video calls showing deepfakes of familiar people, then tricked them into installing malware that stole crypto.
-
How did hackers prolong the FaceStealer attacks after the initial compromise?
Theft and account takeover sometimes occurred months to more than a year after a computer was first compromised. Hackers also used stolen contacts to target additional victims, including open-source software developers who could be attacked through their software.
WatcherGuru
CoinDesk
CoinTelegraph
WuBlockchain