US wins court authority over $1.2bn in Binance hack funds

On Thursday, Nov. 12, the US Justice Department said it had court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance in an October hack. The order moves part of the frozen funds into a legal recovery process, but it does not mean the government has finished taking ownership of them.

The department said the theft happened on or about Oct. 29, when North Korean military members stole more than $6 billion in virtual assets from the exchange. The FBI identifies the actors as TraderTraitor. In its announcement of the court-authorized action, the Justice Department said coordinated efforts by the US government and private-sector partners had frozen more than $2.7 billion. The authorized amount is a portion of that total.

That distinction matters: freezing assets can prevent them from moving while investigators trace them, while seizure and forfeiture are legal steps toward taking control of property. The department’s announcement describes the court authorization as covering both seizure and restraint. It does not say that more than $1.2 billion has already been transferred into government custody or forfeited.

The funds remain part of an active tracing effort. The Justice Department said TraderTraitor actors continue to launder assets through cryptocurrency bridges, mixers and exchanges. Those services can move funds between blockchain networks, pool transactions or provide exchange access, complicating efforts to follow and block the stolen crypto.

The FBI, US Secret Service and Internal Revenue Service’s Criminal Investigation division had issued a cyber alert the previous week, according to the department. It attributed the Binance theft to North Korea and urged virtual-asset service providers to block transactions with, or derived from, cryptocurrency addresses the actors were using to launder the stolen assets.

The FBI’s account of the case does not make the $1.2 billion a new recovery on top of the frozen funds. The Justice Department places it within the more than $2.7 billion frozen through collective US and private-sector action. It said tracing, freezing, seizure and forfeiture efforts are continuing.

Forfeiture is the process that can determine whether seized property can be kept by the government or returned to a claimant. The Associated Press report on the action notes that the government typically files a forfeiture claim with a judge, who then determines who has a legitimate claim to recovered funds. The Justice Department’s announcement did not give a timeline for that process or say how the authorized amount is divided among assets or networks.

The seizure action is separate from another North Korea-related operation announced the same day: the disruption of cloud infrastructure tied to the FBI’s FaceStealer social-engineering scheme. The Justice Department said that scheme had resulted in more than $400 million in cryptocurrency theft over the previous 18 months. It described the infrastructure action and the Binance seizure authorization as coordinated measures against distinct North Korean cryptocurrency theft operations.

Sources and documents

• announcement of the court-authorized action — justice.gov
• Associated Press report on the action — apnews.com