DOJ Secures Court Approval to Seize $1.2 Billion Tied to North Korea’s Binance Hack

What to Know

• The U.S. Justice Department has received court authority to seize more than $1.2 billion in cryptocurrency frozen after the recent Binance theft.
• U.S. authorities and private companies have frozen more than $2.7 billion of the more than $6 billion stolen from Binance on Oct. 29.
• The FBI attributed the Binance attack to TraderTraitor, a North Korean military-linked hacking operation.
• Investigators are tracing stolen cryptocurrency through blockchain bridges, mixers and exchanges as they seek to freeze and recover additional funds.
• Federal agents separately seized cloud infrastructure used in the North Korean FaceStealer hacking campaign.
• The FBI says FaceStealer has stolen more than $400 million in cryptocurrency over the past 18 months.
• The FaceStealer campaign uses fake video meetings resembling Zoom or Microsoft Teams calls to trick victims into installing malware.
• The FBI said it seized more than 900 webcam videos collected by the attackers.

U.S. Authorities Escalate Crypto Theft Crackdown

The U.S. Justice Department has intensified its campaign against North Korea-linked crypto theft, securing court authority to seize more than $1.2 billion in cryptocurrency frozen after the recent Binance hack and moving against technology used in a separate malware operation known as FaceStealer. The actions place renewed focus on how state-linked cyber groups use digital assets, social engineering and laundering networks to fund illicit operations while exploiting weaknesses across the crypto ecosystem.

The seizure approval connected to Binance marks one of the most significant law enforcement steps following the Oct. 29 theft, which U.S. authorities attribute to TraderTraitor, a North Korean military-linked hacking operation. The broader response has involved U.S. agencies and private companies working to freeze more than $2.7 billion of the more than $6 billion stolen from Binance. Investigators are continuing to follow the movement of stolen cryptocurrency across blockchain bridges, mixers and exchanges in an effort to recover more of the funds.

For crypto market participants, the development highlights a central tension in digital asset markets: blockchain transactions can be visible and traceable, yet stolen assets can move rapidly through decentralized tools and international platforms. The DOJ’s court-approved seizure suggests that authorities are increasingly using legal, technical and private-sector coordination to interrupt laundering paths before stolen funds are fully dispersed.

Binance Hack Proceeds Face Court-Approved Seizure

The Justice Department said it has received court authority to seize more than $1.2 billion that had been frozen after the Binance attack. That authorization is part of a larger recovery effort targeting funds allegedly stolen by North Korean hackers and moved through crypto infrastructure designed to obscure transaction trails. While freezing funds can prevent immediate liquidation, formal seizure authority is a separate legal step that can allow the government to take control of assets identified as proceeds of cybercrime.

The Binance hack has drawn particular scrutiny because of the scale of the theft and the attribution to TraderTraitor. The FBI linked the attack to the North Korean military-connected operation, reinforcing long-running concerns that Pyongyang-backed cyber groups have become highly sophisticated in targeting exchanges, protocols and individuals with access to digital assets. U.S. officials have repeatedly framed these thefts as more than ordinary financial crime, arguing that stolen cryptocurrency can help support North Korea’s government and weapons programs.

M. Scott Proctor, principal deputy assistant attorney general for national security at the DOJ, said North Korea’s government bankrolls its regime and illicit weapons program through cryptocurrency theft. He said the announcement shows that the United States will fight back against efforts to profit through cybercrime and that the National Security Division will use available tools to seize and return stolen gains.

The case also underscores the importance of rapid incident response across the crypto industry. Once stolen assets move through bridges, mixers and exchanges, tracing becomes more complex, but not necessarily impossible. Blockchain analytics, exchange compliance teams and law enforcement coordination can help identify wallets, freeze custodial balances and build legal cases around specific flows of funds.

TraderTraitor Attribution Raises National Security Stakes

The FBI’s attribution of the Binance attack to TraderTraitor gives the case a national security dimension. North Korea-linked hacking groups have repeatedly been accused of using cyber operations to target digital assets, with attackers often blending phishing, malware, fake employment schemes and credential theft. In high-value crypto environments, one compromised account, developer machine or internal credential can create a pathway to large-scale losses.

TraderTraitor’s alleged role in the Binance theft reflects a pattern in which cyber operators focus on both technical vulnerabilities and human trust. Rather than relying only on code exploits, state-linked actors often use social engineering to place malware on devices or persuade targets to disclose sensitive information. This approach can be especially dangerous in crypto because private keys, seed phrases, internal signing permissions and exchange access controls can all become targets.

The DOJ’s recovery push may also have a deterrent purpose. If stolen crypto can be frozen and seized before hackers convert it into usable resources, the economic incentive behind major exchange attacks becomes weaker. However, cyber operators can still adapt by shifting laundering methods, fragmenting transactions and seeking jurisdictions or platforms with weaker controls.

FaceStealer Infrastructure Seized

In a separate operation, federal agents seized cloud infrastructure used in FaceStealer, a North Korean hacking campaign that the FBI says has stolen more than $400 million in cryptocurrency over the past 18 months. The campaign relies on fake video meetings that resemble Zoom or Microsoft Teams calls, using familiar workplace tools as part of a deception strategy designed to lower victims’ guard.

FaceStealer operators impersonate trusted contacts using secretly recorded webcam footage from prior victims and, increasingly, AI-generated deepfake videos. Once a target joins a fraudulent meeting, the attackers claim there is a technical problem and instruct the victim to install software or run a command to resolve it. Those instructions instead install malware that can steal cryptocurrency and provide attackers with access to additional systems.

The FBI said it seized more than 900 webcam videos collected by the attackers. That detail illustrates how one successful compromise can feed future attacks: stolen video footage can be recycled to make fraudulent calls appear more convincing, while deepfake tools can further blur the line between legitimate collaboration and malicious impersonation.

The campaign has also targeted developers maintaining widely used open-source software, according to the FBI. That warning is significant because developers can hold privileged access to code repositories, package publishing systems and infrastructure used by many downstream projects. If a developer is compromised, attackers may gain access that extends far beyond one individual wallet or account.

Why Fake Meetings Are Effective Against Crypto Targets

Video-meeting lures have become especially effective because remote work has made unexpected calls, screen-sharing requests and software troubleshooting more common. Attackers exploit that familiarity by creating situations that feel routine: a meeting fails to load, a contact appears to be on camera, or a technical fix is requested. In that moment, a victim may follow instructions that would seem suspicious in another context.

For crypto users and companies, the risks are amplified by the irreversible nature of many blockchain transactions. Once malware captures credentials, wallet data or signing access, attackers may be able to transfer assets quickly. Even when transactions are traceable afterward, recovery depends on whether funds can be frozen before they move beyond cooperative platforms or into more complex laundering routes.

Security teams increasingly treat social engineering as a core crypto risk rather than a secondary concern. Hardware wallets, access segmentation, transaction approval policies and strict device hygiene can reduce exposure, but user behavior remains a critical layer. The FaceStealer operation shows how attackers blend psychological manipulation, stolen media and malware installation instructions to create a convincing trap.

Blockchain Tracing Remains Central to Recovery

Investigators are continuing to trace stolen cryptocurrency through blockchain bridges, mixers and exchanges, the DOJ said. These tools can play very different roles in digital asset markets. Bridges allow value to move between blockchains, mixers can be used to obscure transaction histories, and exchanges may provide liquidity or conversion routes. In a laundering investigation, each step can create both obstacles and evidence.

Unlike cash, many blockchain transactions are publicly recorded, making it possible for analysts to follow asset flows across addresses. But visibility does not guarantee recovery. Hackers may split funds, move them quickly, use multiple chains or try to reach services outside the reach of U.S. legal orders. The freezing of more than $2.7 billion after the Binance hack indicates that coordinated intervention can be effective when stolen assets touch identifiable infrastructure.

Market participants will be watching whether the seizure process leads to further recoveries. Court authority over more than $1.2 billion is a major step, but the remaining stolen funds continue to represent a challenge for investigators, exchanges and compliance teams. The outcome may influence how quickly future victims, platforms and authorities coordinate after large crypto thefts.

Implications for Exchanges and Developers

The DOJ actions send a clear message to exchanges, infrastructure providers and developers: North Korea-linked hacking campaigns remain among the most serious threats facing the digital asset industry. Exchanges may face pressure to improve wallet controls, monitoring systems and incident response playbooks, while developers may need stronger protections around devices, repositories and administrative access.

Open-source maintainers are a particularly sensitive target because their work can support widely used systems. If attackers compromise a trusted maintainer, they may attempt to insert malicious code, steal credentials or move laterally into connected environments. The FBI’s warning about developer targeting suggests that security standards must extend beyond exchanges and into the broader software supply chain that supports crypto markets.

For individual users, the message is simpler but urgent: unexpected video calls, software installation prompts and command-line instructions should be treated with extreme caution, even when they appear to come from trusted contacts. Verification through a separate channel can help prevent attackers from using stolen webcam footage or deepfake media to gain credibility.

Frequently Asked Questions (FAQs)

What did the Justice Department receive approval to seize?

The Justice Department received court authority to seize more than $1.2 billion in cryptocurrency that had been frozen after the recent Binance hack attributed by the FBI to TraderTraitor.

How much was stolen from Binance?

U.S. authorities said more than $6 billion was stolen from Binance on Oct. 29, and more than $2.7 billion has been frozen through efforts involving authorities and private companies.

Who does the FBI say was behind the Binance attack?

The FBI attributed the Binance attack to TraderTraitor, described as a North Korean military-linked hacking operation.

What is FaceStealer?

FaceStealer is a North Korean hacking campaign that uses fake video meetings resembling Zoom or Microsoft Teams calls to trick victims into installing malware that can steal cryptocurrency and provide access to other systems.

How much cryptocurrency has FaceStealer allegedly stolen?

The FBI says FaceStealer has stolen more than $400 million in cryptocurrency over the past 18 months.

How do FaceStealer attackers deceive victims?

Attackers impersonate trusted contacts using secretly recorded webcam footage from previous victims and increasingly use AI-generated deepfake videos, then claim a technical issue requires the target to install software or run a command.

What did federal agents seize in the FaceStealer operation?

Federal agents seized cloud infrastructure used in the FaceStealer campaign, and the FBI said it also seized more than 900 webcam videos collected by the attackers.

Why are blockchain bridges, mixers and exchanges important in this case?

Investigators are tracing stolen cryptocurrency through bridges, mixers and exchanges because those services can be used to move, obscure or convert stolen assets, while also creating points where funds may be identified or frozen.

Why are developers a target in these campaigns?

Developers can maintain widely used open-source software and may hold access to important systems, so compromising a developer could give hackers a pathway into broader software or crypto infrastructure.