DOJ Wins Court Authority to Seize $1.2B of Stolen Binance Crypto
The Justice Department says it has court authority to seize or restrain more than $1.2 billion stolen in the Binance hack, part of a freeze topping $2.7 billion. The FBI also seized cloud infrastructure behind the $400 million FaceStealer fake video call scheme.
More than $1.2 billion of the crypto stolen in the Binance hack is now covered by court authority to seize or restrain it, the U.S. Justice Department said on Nov. 12. The same announcement disclosed that the FBI had taken down cloud infrastructure behind FaceStealer, a separate fake video call scheme.
The $1.2 billion is not new money on top of earlier figures. According to the DOJ, it is part of a freeze of more than $2.7 billion, a joint tally of U.S. government and private-sector efforts. It also comes out of the roughly $2.85 billion Binance said on Nov. 3 had been frozen or intercepted. Until now those funds sat frozen at token issuers; the court authorization lets the government move toward forfeiture. The underlying court papers were not posted, so the exact scope of the order is not public.
Binance has already said it covered all affected assets from company funds, as we reported in our earlier coverage. That coverage is separate from recovering the stolen coins, which is what the DOJ action targets.
The FBI attributes the Oct. 29 theft to North Korean military-linked hackers known as TraderTraitor. The DOJ puts the haul at more than $6 billion, while Binance's figure is $6.34 billion. North Korea has denied involvement. Assistant Attorney General A. Tysen Duva said the department and its partners were able to "immediately halt about half of this historic breach" by freezing assets before they moved beyond law enforcement reach.
M. Scott Proctor of the DOJ cast the case in national security terms:
"The National Security Division will use every tool at its disposal to seize and return North Korea's ill-gotten gains."
M. Scott Proctor, DOJ
Seizure authority is not recovery. The DOJ said TraderTraitor actors are still moving stolen assets through bridges, mixers and exchanges, and that tracing and forfeiture continue. The FBI has seen the assets converted primarily into ether. The department did not say how much of the freeze is bitcoin.
FaceStealer takedown
Separately, the FBI and the U.S. attorney's office in the Central District of California seized cloud infrastructure used in the FaceStealer campaign, which the FBI says stole more than $400 million over 18 months. The scheme uses stolen accounts to send meeting invites, then plays prerecorded webcam video or deepfakes of known figures. It fakes a technical error and delivers malware as the supposed fix.
Under a federal warrant, the FBI seized more than 900 webcam videos of victims. The campaign has also targeted open-source software maintainers. The bureau has published a FLASH report and a hub page on the operation.
Social engineering also runs through Binance's own account of the breach: the exchange says attackers reached its internal wallet-signing service through a multistage operation involving fake job interviews and malware.
What it means
The action shows a freeze-first approach working at scale. By the DOJ's account, roughly half the haul was stopped because assets were frozen before they dispersed, and the court authority now gives the government a path from a freeze toward forfeiture. The rest of the trail still runs through bridges, mixers and exchanges. The DOJ's own announcement frames the work as ongoing, and a court-authorized seizure is not the same as stolen funds being recovered or returned.
