DOJ Seizes $1.2 Billion of Binance Hack as $2.7 Billion Frozen
In this article5 sections
The U.S. Justice Department said a court approved the seizure or restraint of more than $1.2 billion stolen from Binance, part of a larger pool of more than $2.7 billion in frozen funds tied to the exchange’s October hack, according to CoinCentral. The department, which announced the action on Thursday, Nov. 12, attributed the theft to TraderTraitor, a hacking group it links to North Korea’s military.
Separately, the DOJ said it seized cloud systems used in a North Korean fake-video-call operation the FBI calls FaceStealer. CoinCentral reported that the FBI says the campaign took more than $400 million in crypto over 18 months, and that agents seized more than 900 webcam videos collected by the attackers.
Key facts
- Court authorization covers more than $1.2 billion of the Binance theft; the DOJ said that sum sits inside the more than $2.7 billion frozen by U.S. authorities and private companies, not on top of it, per Blockonomi.
- Binance measured the loss at about $6.3 billion and set aside $6.34 billion of company funds; Bitcoin Magazine described it as the largest crypto theft on record and dated the breach to Oct. 29.
- The FBI attributes the Binance attack to TraderTraitor, which Blockonomi reported is linked to North Korea; Blockonomi also noted Pyongyang has denied involvement.
- The FaceStealer campaign, announced the same day, drew more than $400 million in crypto over 18 months, and a federal warrant let the FBI take over 900 webcam videos of victims.
- Binance said Thursday it had completed coverage of affected assets and published a new proof-of-reserves snapshot at 00:00 UTC on Nov. 12 covering 198 tokens, up from 10 in an earlier snapshot.
How FaceStealer worked
Per the Justice Department account, the scheme started with compromised messaging accounts taken from earlier victims. Hackers used those accounts to invite the victim’s contacts to video meetings styled to look like Zoom or Microsoft Teams calls. On the call, the target saw a recording or an AI-generated deepfake of someone they knew, drawn from webcam footage captured from previous targets.
Attackers then reported a technical problem, such as an audio fault, and supplied a fix that installed malware instead. The software could drain crypto or open up other systems. The DOJ said some account takeovers came months to more than a year after the first machine was compromised, meaning the intruders sometimes held back before using stolen access.
Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office, said the scheme “exploits our trust in ubiquitous video conference platforms and valued personal relationships,” and added that people who cannot imagine falling for it are not thinking creatively enough. The FBI also warned that developers maintaining widely used open-source software were targets, since access to a developer’s device could reach that person’s users.
Binance says it has replaced the missing tokens
Binance said Thursday that it “has completed coverage of assets impacted in the security incident.” Bitcoin Magazine reported that this means the exchange has replaced affected tokens from its own books, not that it has recovered the stolen coins. Binance drew on a partial deployment of its Secure Asset Fund for Users, a portion of its futures insurance fund above its risk framework, and its corporate treasury, and said it would replenish SAFU to about $1 billion.
Users cannot yet check the 1:1 backing themselves: Binance said the full zero-knowledge proof would take roughly 40 to 50 hours to generate. Bitcoin Magazine reported that withdrawals were continuing to reopen in phases, having restarted on Nov. 1 with bitcoin before expanding to other networks.
| Measure | Figure |
|---|---|
| Binance loss | About $6.3 billion (Binance), $6.34 billion set aside |
| Frozen in total | More than $2.7 billion |
| Court-approved seizure | More than $1.2 billion |
| FaceStealer proceeds | More than $400 million over 18 months |
Why it matters
M. Scott Proctor, principal deputy assistant attorney general for national security, said North Korea’s government funds its weapons program through crypto theft, and that the National Security Division would use every tool to seize and return stolen funds. For Binance customers, replacement of balances settles their claims while leaving the recovery question open. Blockonomi’s report stresses that neither the frozen total nor the restrained figure means all stolen crypto has been recovered or returned; investigators say the hackers are routing assets through exchanges, mixers and blockchain bridges, and after the breach the FBI observed the attackers converting stolen assets mostly into Ether.
What to watch
The immediate test is Binance’s zero-knowledge proof, due roughly two days after the Nov. 12 snapshot, which would let holders of affected tokens verify 1:1 backing themselves. Also watch the rest of the phased withdrawal queues and any further tracing updates from the DOJ as it tries to freeze more of the funds.
Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.
Sources: CoinCentral, Blockonomi, Bitcoin Magazine
