U.S. Court Orders $1.2B Freeze in North Korea-Linked Binance Hack

By Marcus Bennett

A U.S. court order authorizes the seizure or freezing of more than $1.2 billion in cryptocurrency stolen from Binance by North Korean hackers, the Justice Department said on Nov. 12.

The announcement came as part of a joint operation aimed at disrupting North Korea’s large-scale cryptocurrency theft and money laundering. More than $2.7 billion of the stolen Binance funds has been frozen through cooperation between government agencies and private companies. That total includes the more than $1.2 billion covered by the court order.

The FBI had earlier identified the hackers behind the Oct. 29 Binance hack as TraderTraitor, a group tied to the North Korean military. According to the FBI, TraderTraitor has stolen more than $6 billion in cryptocurrency from Binance.

What is the court order covering?

The order covers assets linked to the Oct. 29 Binance theft, according to the Justice Department. The FBI said the attackers were converting stolen assets primarily into Ethereum and using cross-chain bridges, exchanges and mixers to launder the proceeds.

The Justice Department and FBI are tracing additional funds with the U.S. Secret Service, the Internal Revenue Service Criminal Investigation division and cryptocurrency firms.

Scott Procter, the Justice Department’s principal deputy assistant attorney general for national security, said North Korea is “funding its regime and illegal weapons programs through cryptocurrency theft.” He added that authorities will use every available means to seize and return the illicit proceeds.

The enforcement campaign also reaches beyond Binance. The DOJ said it seized North Korea’s hacking infrastructure, including cloud infrastructure used in so-called Facestealer attacks that caused more than $400 million in losses over the past 18 months.

How do the Facestealer attacks work?

The attacks start with a video meeting. Accounts taken from earlier victims send invitations to people they know, creating the appearance of a trusted conversation.

During the calls, attackers played recorded footage of someone the victim knew or deepfake videos of well-known industry figures. They also recorded new victims’ faces and used that footage in later attacks.

After the meeting began, attackers claimed a technical problem, such as being unable to hear the victim. They then instructed the target to click a link or install a program.

That step installed malware. Attackers used it to steal cryptocurrency or gain access to other systems the victim could reach. Some assets were stolen months, or more than a year, after the initial compromise.

Once attackers obtained victims’ contacts and access to social media and messaging accounts, they sometimes widened their target list to people around them.

Investigators have also found the hackers targeting open-source software developers and maintainers. The goal was to take over developer computers and source-code repository accounts, then infiltrate the software supply chain.

Under a court warrant, the FBI obtained more than 900 webcam videos of victims.

Patrick Grandy, head of the FBI’s Los Angeles field office, said the attacks were sophisticated enough to deceive even skilled technologists with a strong awareness of security risks. “They exploit trust in everyday video-conferencing platforms and in people the victims know,” he said.

What does this change for crypto companies?

For exchanges, bridges, mixers and other crypto firms, the practical change is immediate: law-enforcement requests can lead to the freezing or seizure of identified stolen assets. The DOJ’s $2.7 billion freeze total shows the direct role private companies play in those outcomes.

The FBI has asked the industry to block transactions tied to the wallets involved, while additional tracing continues. That makes wallet screening and cooperation with investigators part of the same enforcement workflow.

The enforcement push will continue as the DOJ and FBI trace additional funds with the Secret Service, IRS Criminal Investigation and crypto companies, and seek to return seized proceeds.