DOJ Gets Court Authority to Seize $1.2 Billion in North Korea-Linked Binance Hack

A federal court has authorized the U.S. Department of Justice to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, out of a joint freeze that now exceeds $2.7 billion. Assistant Attorney General A. Tysen Duva of the DOJ's Criminal Division said the department and its partners were able to "immediately halt about half of this historic breach" by freezing stolen assets "before they got beyond law enforcement reach." The underlying court papers were not posted with the announcement.

The $1.2 billion is not newly recovered money. It comes out of the roughly $2.85 billion Binance said on Nov. 3 had been frozen or intercepted, and Thursday's court authorization is the legal step that lets the government move toward taking ownership of those funds through forfeiture. Until now, the assets had simply been frozen at the token issuers. That distinction matters. A freeze stops the money. Forfeiture transfers it.

What does this change for the stolen funds?

The seizure authority converts a defensive freeze into an offensive recovery process, but it does not close the case. The DOJ said TraderTraitor actors — the North Korea-linked group behind the theft — are still moving stolen assets through cryptocurrency bridges, mixers and exchanges. Tracing, seizure and forfeiture work continues.

The timeline of the attribution is worth noting:

• Oct. 31: The FBI, with the U.S. Secret Service and IRS Criminal Investigation, issued a Cyber Alert attributing the theft to North Korea and urging virtual asset service providers to block transactions with, or derived from, addresses the actors are using.
• The alert said investigators have seen the stolen assets converted primarily into ether.
• The recovery effort is still being run by the FBI's Los Angeles Field Office, Cyber Division and Virtual Asset Unit, alongside the Secret Service and IRS-CI.

The DOJ did not say how much of the $2.7 billion freeze, or of the $1.2 billion under court authority, is bitcoin.

What is the FaceStealer campaign?

On the same day, a separate action surfaced. The U.S. attorney's office in the Central District of California and the FBI announced the seizure of cloud-based infrastructure used in a social engineering campaign the FBI calls FaceStealer. The bureau said the scheme has stolen more than $400 million in cryptocurrency over the last 18 months. It has also targeted people who maintain open-source software — a step the FBI said appears calculated to enable supply-chain attacks.

The method is a fake video call. According to a Thursday FBI FLASH report, North Korean hackers — known publicly under names including APT38 and BlueNoroff — lure targets with meeting invitations sent from accounts stolen from earlier victims. The meetings run on imposter versions of Zoom, Microsoft Teams and Google Meet, with invitations often moving through hijacked Telegram, LinkedIn, Slack or Discord accounts.

Once a target joins, the hackers play a prerecorded webcam video of someone the target knows, or a deepfake of a well-known figure in the cryptocurrency industry. Then comes a fake technical error and a "fix" that installs malware. In several cases, the theft came months to more than a year after the first compromise, as the hackers waited for wallet balances to grow.

Pursuant to a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims. The bureau has posted a hub for the campaign at fbi.gov/facestealer.

One charge, two fronts

Principal Deputy Assistant Attorney General for National Security M. Scott Proctor tied both actions to a single thesis. "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," he said.

For exchanges, the operational message is direct. The Oct. 31 alert puts VASPs on notice to screen the flagged addresses. For wallet custodians and open-source maintainers, the FLASH report documents a live, patient adversary — one willing to wait a year for a balance to grow. The forfeiture window on the $1.2 billion is now open, and further seizure orders are likely as tracing work continues.