US Secures Authority Over $1.2B in Binance Hack

On November 12, the U.S. Justice Department said it had obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance in an October 29 attack attributed to North Korean hackers.

The action puts a legal hold on a substantial share of the stolen assets while investigators and private-sector firms work to keep the rest from being laundered.

The Justice Department’s announcement distinguishes that court-authorized amount from the broader recovery effort: U.S. agencies and private companies have frozen more than $2.7 billion in total. The department said it had obtained authorization for more than $1.2 billion of that sum. It did not say that all of the court-authorized assets had already been transferred into government custody.

The theft itself exceeded $6 billion, according to the department. The FBI attributes it to North Korean military members it calls TraderTraitor. Its October 31 cyber alert said the actors had been converting stolen assets primarily into ether, and urged virtual asset service providers to block transactions involving listed addresses or funds derived from them.

The response relies on cooperation with virtual asset service providers, or VASPs, to interdict assets before they move beyond law enforcement’s reach. The Justice Department said agencies worked with those providers after the theft to freeze the funds. It named cryptocurrency bridges, mixers and exchanges as routes TraderTraitor actors continue to use to launder the stolen assets, and said efforts to trace, freeze, seize and forfeit them remain ongoing.

That distinction matters for how to read the headline figure. A freeze restricts movement of assets, while court authorization gives the government legal authority to seize or restrain the specified cryptocurrency. The Justice Department reported both a larger frozen total and a smaller amount covered by its court authorization; it did not describe the $1.2 billion as a completed forfeiture or say it had been returned to Binance or its customers.

The FBI’s alert also asked VASPs to block transactions with or derived from addresses used by TraderTraitor. In describing the laundering risk, it said the actors were expected to move assets through decentralized finance and instant-swap services after converting them, chiefly, to ether. The Justice Department’s later update said the actors were continuing to use bridges, mixers and exchanges. Neither announcement provides a final accounting of recovered funds or a breakdown of the $1.2 billion by token or seizure method.

The Justice Department described the Binance theft as separate from another North Korean operation announced the same day: the FaceStealer social-engineering scheme, which it said had stolen more than $400 million in cryptocurrency over 18 months. That investigation involved a separate infrastructure seizure. The Binance action concerns assets from the October attack, and officials said work to trace and recover them continues.

Sources and documents

• Justice Department’s announcement — justice.gov
• October 31 cyber alert — fbi.gov