Binance Hack: DOJ Cleared to Seize $1.2B of North Korea's Haul

US prosecutors now hold court approval to go after upward of $1.2 billion in tokens taken during October's Binance breach, the Justice Department said Thursday. That sum sits inside a wider freeze worth over $2.7 billion, which officials say stopped roughly half of the heist before the money slipped away. On the same day, the FBI disclosed that it had taken down server infrastructure behind a separate North Korean deepfake video-call scam it blames for losses above $400 million.

What the court approval changes

The $1.2 billion is not freshly recovered money. On Nov. 3, Binance put the frozen or intercepted total at about $2.85 billion, and the figure announced Thursday is drawn from that pool. Until now those tokens were only locked in place by their issuers. A judge's sign-off is the legal step that allows the government to start working toward forfeiture, meaning eventual ownership of the funds.

Several details are still missing:

• The court filings behind the announcement were not published alongside it.
• The $2.7 billion freeze is a combined number covering both government and private-sector action, with no breakdown given.
• The DOJ did not disclose what share of either figure is held in bitcoin.

A. Tysen Duva, the assistant attorney general over the department's Criminal Division, credited quick freezing by the DOJ and its partners with stopping "about half of this historic breach."

Background: the October breach and who is blamed

According to the DOJ, the theft happened on or around Oct. 29, when attackers took upward of $6 billion in digital assets out of Binance. The FBI attributes it to a unit it tracks as TraderTraitor, which it describes as part of North Korea's military. Binance's own accounting is slightly higher: the exchange says it has covered $6.34 billion.

That coverage is a separate matter from the government's recovery effort. Binance says customers were made whole with company money rather than with recovered coins, drawing on three sources: its Secure Asset Fund for Users, part of the insurance fund backing its futures business, and its corporate treasury. Whatever prosecutors eventually claw back is therefore a different track from the customer reimbursement, which the exchange describes as complete.

On Oct. 31, the FBI, together with the Secret Service and the IRS's criminal investigators, published an alert formally pinning the theft on North Korea. It asked exchanges and other service providers to refuse any transaction linked to the attackers' addresses, and noted that most of the loot had been swapped into ether.

The money is still moving

The freeze has not ended the chase. The DOJ says the hackers continue to push the remaining funds through mixers, cross-chain bridges and trading venues, while investigators keep tracing and seizing what they can. The FBI's Los Angeles Field Office is leading that work alongside the bureau's cyber and virtual-asset specialists.

FaceStealer: fake video calls that drain wallets

The second action targets a campaign the FBI calls FaceStealer. Federal prosecutors in California's Central District and the bureau seized cloud infrastructure supporting it. The FBI links the scheme to hackers known publicly as APT38 and BlueNoroff, and says it has cost victims over $400 million across the past year and a half.

The approach relies on trust. Victims receive a meeting invite from an account that was itself hijacked from an earlier victim, often on LinkedIn, Discord, Slack or Telegram. The call takes place on a counterfeit copy of Google Meet, Zoom or Microsoft Teams. There the attackers show recorded webcam footage of someone familiar, or an AI-generated likeness of a prominent crypto figure. A staged glitch follows, and the supposed repair file is actually malware.

The attackers were patient. In several cases, the FBI says, the theft came anywhere from several months to over a year following the initial infection, once wallet balances had grown. Agents acting under a federal warrant recovered over 900 recordings of victims' webcams. The bureau adds that people who maintain open-source software were also targeted, which it reads as groundwork for supply-chain attacks.

Our assessment

Freezing close to half of a multibillion-dollar theft is unusual, and it shows how much leverage token issuers and compliant platforms now have over stolen funds. But more than half of the haul remains unaccounted for and, by the DOJ's own account, is still in motion. Forfeiture also raises a question the announcement leaves open: with customers already repaid from Binance's reserves, where do recovered assets ultimately go? M. Scott Proctor, a senior DOJ national security official, said Pyongyang uses such thefts to fund what he called its "rogue regime and illicit weapons program." The points to watch are the unsealed court papers, the asset breakdown of the frozen funds, and whether the ether conversions noted by the FBI continue.