US DOJ Moves to Seize Over $1.2B in Crypto Stolen From Binance

TL;DR

• The DOJ obtained court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, part of over $2.7 billion frozen.
• Authorities attributed the theft of more than $6 billion to North Korea’s TraderTraitor operation and continue tracing funds across bridges, mixers and exchanges.
• A DOJ action disrupted FaceStealer infrastructure, a North Korean social-engineering campaign blamed for more than $400 million in cryptocurrency thefts over 18 months.

The U.S. Department of Justice has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance during the October 29 breach attributed by the FBI to North Korea’s TraderTraitor operation. In its official announcement, the DOJ said public-private cooperation has frozen more than $2.7 billion of the stolen assets. The action converts part of the recovery effort from asset freezing into a court-backed seizure process, while showing how crypto scams and cyberattacks increasingly intersect with national-security enforcement.

Authorities Continue Tracing Billions From the Binance Theft

The Binance theft involved more than $6 billion in virtual assets, according to the DOJ, which said members of the North Korean military operating as TraderTraitor were responsible. U.S. agencies have worked with virtual asset service providers to identify and interdict the stolen funds, while tracing remains active across multiple networks. More than $2.7 billion has been frozen, but only part of that amount is covered by the newly announced court authorization. The action follows the FBI’s attribution of the Binance theft to TraderTraitor and its publication of addresses linked to the stolen assets.

Investigators say remaining funds continue moving through cryptocurrency bridges, mixers and exchanges, complicating recovery as actors attempt to break transaction trails across platforms. The FBI, Secret Service and IRS Criminal Investigation have urged service providers to block transactions involving or derived from addresses associated with the operation. The recovery effort therefore depends on coordinated tracing, freezing and forfeiture rather than a single seizure event. That process mirrors the challenge created by cross-chain laundering routes used after the Binance breach, where stolen assets were shifted between blockchains and converted into different cryptocurrencies.

The DOJ announcement also described a separate disruption against FaceStealer, a North Korean social-engineering campaign that authorities say stole more than $400 million in cryptocurrency over the previous 18 months. Investigators said operators used recorded webcam footage, artificial deepfakes and fake technical problems during video meetings to install malware, later stealing crypto or exploiting access to other infrastructure. The FBI seized more than 900 victim webcam videos under a federal warrant. The two actions show U.S. authorities targeting both stolen assets and the infrastructure used to obtain them. The push adds to U.S. efforts to seize cryptocurrency linked to networks, while the DOJ says forfeiture efforts involving the Binance assets remain ongoing.