DOJ authorizes $1.2 billion seizure after Binance theft by North Korea

By Daniel Okafor

The U.S. Department of Justice authorized the seizure of $1.2 billion in cryptocurrency stolen from Binance in an Oct. 29 attack, according to a DOJ statement.

The FBI attributed the attack to TraderTraitor, a North Korean military-linked hacking operation. The DOJ said the seizure forms part of an aggressive effort to take control of infrastructure and assets supporting North Korean cryptocurrency-theft operations aimed at stealing billions, including technology used in FaceStealer attacks.

U.S. authorities and private companies have frozen more than $2.7 billion of the more than $6 billion taken from Binance on Oct. 29, according to the DOJ. A linked TraderTraitor explainer puts the heist at $6.3 billion.

What does the Binance seizure change?

Operationally, the seizure gives U.S. authorities control over the identified holdings and supports the DOJ’s stated goal of returning them, although the announcement did not specify a recovery timetable. The freeze also extends the case across both government and private-sector enforcement channels.

The DOJ said investigators are tracing stolen cryptocurrency moving through:

• Blockchain bridges
• Mixers
• Cryptocurrency exchanges

Their stated objective is to freeze and recover more of the stolen funds.

How does FaceStealer operate?

Separately, federal agents seized cloud infrastructure used in FaceStealer, a North Korean campaign the FBI says has stolen more than $400 million in cryptocurrency over the past 18 months.

FaceStealer uses fake video meetings resembling Zoom or Microsoft Teams calls. Hackers impersonate trusted contacts with secretly recorded webcam footage from previous victims and, increasingly, AI-generated deepfake videos.

After a target joins, the attackers claim there is a technical problem and direct the victim to install software or run a command to fix it. The instructions instead install malware that can steal cryptocurrency and give attackers access to other systems.

The FBI said it seized more than 900 webcam videos collected by the attackers. The campaign has also targeted developers maintaining widely used open-source software, and the FBI warned that compromising a developer could allow hackers to gain access.

What is the enforcement strategy?

M. Scott Proctor, principal deputy assistant attorney general for national security at the DOJ, said in a statement:

“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft. Today’s announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime. The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.”

The actions target two operational layers: the proceeds and the infrastructure. The seizure addresses the stolen funds, while the FaceStealer action takes control of cloud infrastructure used to stage attacks. Private companies’ participation in the freeze extends enforcement beyond the government’s own asset-tracing channels.

What happens next?

The coming enforcement window depends on how quickly investigators identify assets moving through bridges, mixers and exchanges, and whether those assets remain within reach of U.S. and partner enforcement. The DOJ announced no deadline for completing the recovery process, so additional seizures will hinge on continued tracing and private-sector freezes.