US DOJ Secures Court Approval to Seize $1.2 Billion in Stolen Binance Crypto

Court Orders Target More Than $1.2 Billion

The U.S. Department of Justice (DOJ) announced on Nov. 12 that it had obtained court authorization to seize or restrain stolen Binance assets worth more than $1.2 billion. The funds form part of a larger pool of more than $2.7 billion frozen through coordinated efforts between government agencies and private-sector partners. The department attributed the theft of more than $6 billion, which took place around Oct. 29, to North Korean military hackers.

Principal Deputy Assistant Attorney General for National Security M. Scott Proctor said: “The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.”

Court authorization of this kind is an intermediate step rather than a final recovery: seized or restrained assets remain subject to follow-on forfeiture proceedings in court before any ultimate disposition is decided.

Funds Linked to Weapons Financing

The DOJ tied North Korea’s cryptocurrency thefts to financing its government and illicit weapons program, a connection that United Nations sanctions monitors have repeatedly documented in their public reporting on North Korean cyber operations. Under the court orders, seizure places assets under government custody or control, while restraint restricts their transfer while proceedings continue.

The same Nov. 12 announcement also covered Facestealer, a separate North Korean scheme that used secretly recorded videos and deepfakes to target people in the cryptocurrency and Web3 sectors. According to the DOJ, the operation stole more than $400 million over 18 months, and the FBI seized the cloud infrastructure behind it along with more than 900 webcam videos of victims.

Binance said on Nov. 12 that it had completed coverage of the affected assets after committing more than $6.34 billion in company funds to cover the losses. The exchange also published a reserve snapshot covering 198 tokens, which captured balances at midnight UTC that day. Reserve snapshots are an industry transparency practice, allowing customers to verify that custodial balances are backed by on-chain holdings.

FBI Sought Blocks on Theft-Linked Transactions

In an Oct. 31 alert, the Federal Bureau of Investigation (FBI) attributed the Binance theft to Tradertraitor, its designation for North Korean hacking activity. Working with the U.S. Secret Service and IRS Criminal Investigation, the bureau observed the attackers converting stolen assets primarily into ether. It expected further laundering through decentralized finance and instant-swap services, which exchange one cryptocurrency for another.

Authorities urged exchanges, infrastructure operators, and other digital asset businesses to block transactions involving or derived from the identified addresses. Blocking such flows depends on transaction screening, the practice of flagging deposits tied to addresses published in incident alerts. North Korea denied responsibility for the Binance hack on Nov. 3. Kim Yo-jong, the sister of North Korean leader Kim Jong Un, rejected the FBI’s attribution in a statement carried by state media.

According to the DOJ, investigators were pursuing funds moving through bridges that transfer assets between blockchains, mixers, and exchanges. The department said tracing, freezing, seizure, and forfeiture work remained underway as the attackers continued laundering the assets.

Laundering Network Complicates Recovery

Blockchain analytics firm Elliptic, which traces cryptocurrency transactions to identify illicit activity, tracked conversions of the stolen Solana, XRP, and Tron into bitcoin. Its Nov. 13 update counted nearly 27,000 wallets, at least 16 blockchains, at least 36 services, and more than 83,000 transactions across the laundering operation.

The firm also identified meme coins used to disguise Binance theft proceeds on Tron, Solana, and NEAR. Newly created tokens featured in the Tron and NEAR activity, while the Solana tactic involved existing assets. Trading through token liquidity pools allowed the stolen funds to pass between wallets without a direct transfer linking the sender and recipient.

Elliptic’s update covering Nov. 11–13 described light activity beyond additional XRP swaps. Converted proceeds had reached roughly 4,100 bitcoin, valued at $285 million at the time. Its mixing estimates included roughly 11,000 ether in laundering-linked deposits into Tornado Cash, a mixing protocol the U.S. Treasury sanctioned in 2022 over its use in laundering stolen funds. Future forfeiture filings and successive analytics updates will indicate how much of the stolen total ultimately moves from frozen to recovered.

Source: CryptoNewsNet