U.S. authorities have obtained court approval to seize or restrain more than $1.2 billion in cryptocurrency stolen in the October hack of the Binance cryptocurrency exchange. The Justice Department announced the action on Nov. 12, two weeks after the exchange disclosed the theft, in an official press release. The targeted funds form part of a broader total of more than $2.7 billion frozen through combined government and private-sector efforts.

The FBI attributes the attack to TraderTraitor, a hacking group it links to North Korea, while Binance has estimated its losses at $6.34 billion, a figure that remains well above the amounts frozen so far. In a separate operation, federal agents also seized cloud infrastructure linked to FaceStealer, a fake video-call scheme that officials say stole more than $400 million in cryptocurrency over the past 18 months. The department framed the two measures as part of its effort to disrupt what it describes as North Korea's massive theft of cryptocurrency.

Court Orders Target Binance Hack Proceeds

The FBI attributed the attack, which took place on Oct. 29 and affected several cryptocurrencies held by the exchange, to the TraderTraitor group. North Korea has denied involvement in the theft, but U.S. officials say cryptocurrency theft helps fund the country's government and weapons programs.

According to the Justice Department, the more than $1.2 billion covered by court authorization is included within the larger frozen total, not an additional sum to be added to the $2.7 billion. Freezing assets can prevent them from being moved, while court-authorized seizure or restraint represents another step in the legal process. Neither figure means that all of the stolen cryptocurrency has been recovered or returned.

Investigators are still tracing the assets as hackers move funds through exchanges, mixers, and bridges, according to the department. Bridges transfer assets between blockchains, while mixers can obscure their transaction histories.

After the hack, the FBI said it had observed the attackers converting stolen assets primarily into Ether. The agency urged cryptocurrency service providers to block transactions linked to identified addresses.

Binance said attackers accessed an internal wallet-signing service and initiated transfers outside its normal withdrawal process. Its investigation described a multistage operation involving fake job interviews, malware downloads, and compromised internal tools, and the exchange said independent security firms would provide further reviews after the attack.

On Nov. 12, Binance said it had completed coverage of the assets affected by the hack using company resources. The exchange also published a new reserve snapshot, though the accompanying cryptographic proof, the element typically used to make such snapshots independently verifiable, was still pending. Replacing affected assets does not mean the exchange has recovered all of the stolen coins, and both the pending proof and the independent reviews Binance said would follow remain open items.

How FaceStealer Used Fake Meetings to Steal Crypto

Authorities announced the FaceStealer enforcement action separately from the Binance hack case. The Justice Department said it seized cloud infrastructure used by the North Korean hackers behind the campaign, an action aimed at the hosting and tooling behind the scheme rather than at specific stolen funds. The FBI said FaceStealer targeted people working in cryptocurrency and Web3, and that attackers also increasingly pursued developers who maintain open-source software.

The scheme began with compromised messaging accounts belonging to earlier victims. Hackers used those accounts to invite the victims' contacts to video meetings on sites designed to resemble Zoom or Microsoft Teams. Once inside, targets saw recordings of people they recognized, according to investigators. In some cases, attackers also used AI-generated videos of well-known figures in the crypto industry.

The hackers then claimed there was a technical problem, such as an audio issue, and supplied a link or instructions for a supposed fix that instead installed malware. The software could help them steal cryptocurrency or access other systems. Compromised accounts also gave attackers access to contacts and past conversations, information that helped them approach new targets with messages that appeared to come from someone familiar.

Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims. Investigators said attackers could reuse recordings from one victim to impersonate that person in later fake calls with the victim's trusted contacts.

The FBI also warned that access to a developer's device or software accounts could enable attacks on the widely used applications that developer maintains, a breach that could expose anyone who downloads that software.

Source: Blockonomi