DOJ moves to seize $1.2 billion stolen in the Binance hack

The U.S. Justice Department said on Thursday, Nov. 12, that it has court authorization to seize or restrain more than $1.2 billion in crypto stolen from Binance on Oct. 29, roughly a fifth of the more than $6 billion taken. In the same announcement it disclosed the seizure of cloud servers behind FaceStealer, a North Korean fake video-call scheme the FBI links to more than $400 million in thefts over 18 months.

The FBI attributes the Binance theft to a North Korean military unit it calls TraderTraitor, as we reported when the FBI blamed North Korea for the Binance hack. According to the Justice Department release, U.S. agencies and private firms have frozen more than $2.7 billion of the stolen assets so far, and the court orders cover more than $1.2 billion of that frozen pool.

A freeze stops funds from moving. A court-authorized seizure or restraint goes further and puts the assets under U.S. government control while forfeiture proceedings run. The release describes efforts to "trace, freeze, seize, and forfeit" the coins, but it gives no amount, date or method for returning anything to Binance or its customers. Our earlier look at how much of the stolen crypto was frozen explains why that share shapes any recovery.

Assistant Attorney General A. Tysen Duva said the Criminal Division helped "immediately halt about half of this historic breach." The laundering continues through bridges, mixers and exchanges, CoinDesk reported, citing DOJ. Last week the FBI, the Secret Service and IRS-CI also asked crypto service providers to block transactions with addresses tied to the stolen assets.

The scheme starts with a meeting invite sent from an account stolen from an earlier victim. When the target joins, the hackers record their webcam and play pre-recorded clips of people the target knows. DOJ says they also use AI-generated deepfakes of well-known crypto and Web3 figures to win trust.

Then comes a fake technical problem, such as a claim that the target cannot be heard, along with a link or prompt to fix it. The fix installs malware. Citing the FBI alert, CyberScoop reported that invites arrive through hijacked Telegram, LinkedIn, Slack and Discord accounts and lead to typo-squatted copies of Zoom and Microsoft Teams. In several cases, DOJ said, the theft came months or more than a year after the first compromise.

Under a federal warrant the FBI seized more than 900 webcam videos of victims. The group has also turned to open-source maintainers, trying to reach the code repositories they control, a pattern DOJ said "appears calculated to enable software supply-chain attacks."