The U.S. Department of Justice said Thursday that it has obtained court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance — part of a wider freeze of more than $2.7 billion that officials said halted roughly half of North Korea's October exchange heist.

In a Thursday announcement, the department said that on or about Oct. 29, members of the North Korean military — referred to by the FBI as TraderTraitor — stole more than $6 billion worth of virtual assets from Binance. That figure sits below the $6.34 billion Binance has covered since the attack.

Binance said it had completed coverage of the assets hit in the breach, replacing the affected tokens from company funds rather than by recovering the stolen coins, according to the exchange's statement. The two efforts run on separate tracks: the DOJ is working to interdict what was taken, while Binance has said users were made whole through its Secure Asset Fund for Users (an emergency reserve the exchange created in 2018), a portion of its futures insurance fund and its treasury.

Assistant Attorney General A. Tysen Duva of the DOJ's Criminal Division said the department and its partners were able to “immediately halt about half of this historic breach” by freezing stolen assets “before they got beyond law enforcement reach.”

The freeze of more than $2.7 billion is a joint figure covering U.S. government and private-sector efforts. Of that total, the DOJ said it has already obtained court authorization to seize or restrain more than $1.2 billion; no court authority has been announced for the remainder of the frozen funds. The underlying court papers were not posted with the announcement.

The $1.2 billion is not newly recovered money. It comes out of the roughly $2.85 billion that Binance said on Nov. 3 had been frozen or intercepted, and Thursday's court authorization is the legal step that allows the government to move toward taking ownership of those funds through forfeiture. Until now, the assets had simply been frozen at the token issuers.

Even the freeze does not mark the end of the trail. According to the DOJ, TraderTraitor actors are still moving the stolen assets through cryptocurrency bridges, mixers and exchanges — services that complicate the task of tracing stolen funds — and tracing, seizure and forfeiture work continues.

Last week, on Oct. 31, the FBI, together with the U.S. Secret Service and IRS Criminal Investigation, issued a Cyber Alert attributing the theft to North Korea and urging virtual asset service providers to block transactions with, or derived from, addresses the actors are using. The alert said investigators have seen the stolen assets converted primarily into ether. U.S. agencies and United Nations investigators have attributed years of high-value exchange thefts to North Korea-linked hacking units, with proceeds that U.N. reporting says help fund the regime's weapons programs.

A Separate $400 Million Deepfake Scheme, and 900 Seized Videos

Separately from the DOJ and Binance case, the U.S. attorney's office for the Central District of California and the FBI announced the seizure of cloud-based infrastructure used in a social engineering campaign the bureau calls FaceStealer. The FBI said the scheme has resulted in the theft of more than $400 million in cryptocurrency over the last 18 months and has also been used in attempts to compromise people who maintain open-source software — a step the bureau said appears calculated to enable supply-chain attacks.

The method is a fake video call. According to the FBI, North Korean hackers known publicly under names including APT38 and BlueNoroff lure targets with meeting invitations sent from accounts stolen from earlier victims. Once a target joins, the hackers play a prerecorded webcam video of a person the target knows, or a deepfake of a well-known figure in the cryptocurrency industry, then introduce a fake technical error and send a “fix” that installs malware. In several cases, the theft came months to more than a year after the first compromise, as the hackers waited for wallet balances to grow.

A Thursday FBI FLASH report said the meetings run on imposter versions of Zoom, Microsoft Teams and Google Meet, with invitations often moving through hijacked Telegram, LinkedIn, Slack or Discord accounts. Pursuant to a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims. The bureau has posted a hub for the campaign at fbi.gov/facestealer.

Principal Deputy Assistant Attorney General for National Security M. Scott Proctor tied both of Thursday's actions to the same charge: “North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft.”

The Binance recovery effort remains led by the FBI's Los Angeles Field Office, its Cyber Division and Virtual Asset Unit, working with the Secret Service and IRS Criminal Investigation. The DOJ did not say how much of the more than $2.7 billion freeze, or of the $1.2 billion now under court authority, is bitcoin.

This article is based on reporting by Micah Zimmerman, originally published by Bitcoin Magazine.