United States authorities have won court approval to seize or restrain more than 1.2 billion dollars in cryptocurrency stolen from Binance, the Justice Department said on Thursday. The Binance hack is the largest known crypto theft on record. The Federal Bureau of Investigation has blamed the attack on a North Korean military hacking unit it calls TraderTraitor.
The Binance hack took place on or about October 29 and involved more than 6 billion dollars in virtual assets, the department said. Binance has put the loss at 6.34 billion dollars. Government and private-sector efforts have frozen more than 2.7 billion dollars so far. The 1.2 billion dollars covered by the court orders sits inside that frozen total and is not an extra sum on top of it.
Court orders in the Binance hack case are a further step in the legal process. Freezing assets can stop them from being moved, while a court order to seize or restrain them gives the government a legal claim to take control. Neither figure means that all of the stolen cryptocurrency has been recovered or returned. Investigators are still tracing the assets as the hackers move funds through exchanges, mixers and bridges.
How the Binance hack unfolded
Binance said the attackers got into an internal wallet-signing service and started transfers outside its normal withdrawal process. The exchange described a multistage operation that used fake job interviews, malware downloads and compromised internal tools. The FBI said it had seen the attackers convert stolen assets mainly into Ether. The agency urged crypto service providers to block transactions linked to addresses it had identified.
On November 12, Binance said it had completed coverage of the assets affected by the Binance hack using its own resources. The exchange published a new reserve snapshot, although the cryptographic proof that goes with it was still pending. Replacing the affected assets does not mean the exchange has recovered all of the stolen coins.
The FBI attributes the Binance hack to TraderTraitor, a group it links to North Korea. The hackers are also known publicly as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, Advanced Persistent Threat 38, BlueNoroff and Stardust Chollima. North Korea has denied any part in the theft. United States officials say cryptocurrency theft helps fund the North Korean government and its weapons programmes.
FaceStealer scheme dismantled in the same action
In a separate operation announced on the same day, agents seized cloud-based infrastructure behind a social engineering scheme the FBI calls FaceStealer. The scheme stole more than 400 million dollars in cryptocurrency over 18 months, federal officials said. The FBI also seized more than 900 secretly recorded webcam videos that the hackers could use to impersonate victims in later attacks.
FaceStealer targeted people who work in cryptocurrency and Web3, and it increasingly went after developers who maintain open-source software. The hackers took over messaging accounts that belonged to earlier victims and used them to invite contacts to video meetings on sites that resembled Zoom or Microsoft Teams. Targets saw recordings of people they recognised, and in some cases videos made with artificial intelligence that showed well-known figures in the crypto industry. The hackers then claimed there was a technical problem, such as an audio fault, and sent a link or instructions for a supposed fix that installed malware instead.
The FBI credited the cybersecurity firms Arctic Wolf, Jumpsec and Microsoft Threat Intelligence Center with help in the investigation and seizure. The bureau’s Los Angeles field office, its Cyber Division and its Virtual Asset Unit are leading the effort to recover the assets stolen in the Binance hack, working with the Secret Service and the Internal Revenue Service.
What the Binance hack seizure means for victims
A. Tysen Duva, the assistant attorney general in charge of the Justice Department’s Criminal Division, said its computer crime section and its partners froze the assets stolen in the Binance hack before they got beyond the reach of law enforcement. He said the action halted about half of this historic breach. M. Scott Proctor, the principal deputy assistant attorney general for national security, said the department would keep working to trace the funds.
The Justice Department has not said who will receive the money, or when. The release did not name the court or the judge, or say which coins make up the 1.2 billion dollars. The FBI issued a cyber alert on October 31 that attributed the theft to TraderTraitor, and it published a detailed report on FaceStealer on Thursday with guidance for people who want to protect themselves. The Binance hack remains under active investigation, and officials said the hackers keep moving funds through crypto bridges, mixers and exchanges.