DOJ wins court approval to seize or restrain $1.2B in stolen Binance crypto

What happened

The U.S. Department of Justice said on Nov. 12 that it had obtained court authorization to seize or restrain cryptocurrency worth more than $1.2 billion that was stolen from Binance, according to reports from Bitcoin.com News and The Daily Hodl. The order applies to one slice of a larger pool: officials say more than $2.7 billion has been frozen so far through cooperation between government agencies and the private sector.

The department puts the size of the theft at more than $6 billion and dates it to on or around Oct. 29. It blames North Korean military hackers, the group the FBI designates as Tradertraitor. M. Scott Proctor, principal deputy assistant attorney general for national security, said the National Security Division would deploy every tool available to seize and return what he called North Korea's ill-gotten gains.

The two legal tools at issue work differently. A seizure places assets in government custody, while a restraint prevents them from being moved while court proceedings continue. According to the department, investigators are still tracing, freezing and pursuing forfeiture of the remaining funds, and the attackers are continuing to launder money through bridges that move assets between blockchains, mixers and exchanges.

The Nov. 12 announcement also addressed a separate North Korean operation known as Facestealer. The DOJ said that scheme, which relies on stolen accounts, secretly recorded videos and AI-generated deepfakes to stage bogus video meetings, took more than $400 million over 18 months from people in the cryptocurrency and Web3 sectors. The FBI seized cloud infrastructure supporting the operation along with more than 900 webcam videos of victims, the department said.

Why it matters

The department links North Korean cryptocurrency theft to funding for the country's government and its illicit weapons programs, which is why the recovery effort is being handled with national security interest rather than as an ordinary fraud case. The figures involved are large enough to matter to the exchange and its users as well: Binance said on Nov. 12 that it had finished covering affected assets after committing more than $6.34 billion of its own funds to absorb the losses, and it published a reserve snapshot covering 198 tokens with balances captured at midnight UTC that day.

The case also illustrates how enforcement now runs alongside industry action. The FBI's earlier alert asked exchanges, infrastructure operators and other digital asset businesses to block transactions involving or derived from addresses identified by investigators, putting compliance teams on the front line of efforts to stop the money from moving.

What the data shows

Blockchain analytics firm Elliptic, which traces transactions to identify illicit flows, tracked stolen solana, XRP and tron being converted into bitcoin. Its Nov. 13 update counted close to 27,000 wallets, at least 16 blockchains, at least 36 services and more than 83,000 transactions involved in the laundering operation. Converted proceeds had reached roughly 4,100 bitcoin, worth about $285 million at the time, and the firm estimated that around 11,000 ether tied to the laundering had been deposited into Tornado Cash.

Elliptic also described meme coins being used to hide the origin of proceeds on Tron, Solana and Near, with newly created tokens central to the Tron and Near activity and existing assets used on Solana. Trading through token liquidity pools, the firm said, let funds pass between wallets without a direct transfer linking sender and recipient. Its update covering Nov. 11 to 13 showed little activity beyond further XRP swaps.

Background

In an Oct. 31 alert, the FBI attributed the Binance theft to Tradertraitor, its label for North Korean hacking activity, and said it had worked with the U.S. Secret Service and IRS Criminal Investigation on the case. The bureau observed the attackers converting stolen assets mainly into ether and said it expected further laundering through decentralized finance and instant-swap services that exchange one token for another. North Korea rejected the accusation: on Nov. 3, Kim Yo-jong, the sister of the country's leader, denied the FBI's attribution in a statement carried by state media.

What to watch

The next developments to follow are the progress of forfeiture proceedings over restrained assets and whether investigators can keep pace with laundering that is still in motion. The Justice Department has not said how much of the $2.7 billion frozen may ultimately be returned, and the gap between the more than $6 billion taken and the sums secured so far leaves most of the loss unresolved. Attention will also fall on the Facestealer case, whose targets were people working in crypto and Web3, and on whether exchanges act on the FBI's request to block transactions tied to flagged addresses.

Questions readers ask