The DOJ obtained court authority Thursday to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance by North Korean military actors in an October breach. The seizure authority covers part of a $2.7 billion freeze of stolen assets that the DOJ said halted roughly half of the heist.
On or about Oct. 29, members of the North Korean military, tracked by the FBI as TraderTraitor, stole more than $6 billion in virtual assets from Binance. Binance reported the total at $6.34 billion. The exchange covered losses to users through its Secure Asset Fund for Users, a portion of its futures insurance fund, and its treasury, replacing tokens from company funds rather than recovering the stolen coins.
The $1.2 billion now under court authority came from the $2.85 billion Binance said on Nov. 3 had been frozen or intercepted. The court authorization marks a legal step toward forfeiture and taking ownership of the funds, whereas previously they remained frozen at token issuers. Assistant Attorney General A. Tysen Duva said the department and partners were able to "immediately halt about half of this historic breach" before stolen assets "got beyond law enforcement reach."
The FBI said North Korean hackers known as APT38 and BlueNoroff are still moving stolen assets through cryptocurrency bridges, mixers and exchanges. An Oct. 31 FBI Cyber Alert attributed the theft to North Korea and urged virtual asset service providers to block transactions with addresses the actors use. Investigators observed the stolen assets converted primarily into ether.
In a separate action, the U.S. attorney's office in the Central District of California and the FBI announced seizure of cloud-based infrastructure tied to a social engineering campaign called FaceStealer. The FBI said the scheme resulted in theft of more than $400 million in cryptocurrency over 18 months. North Korean hackers lured targets with fake video meeting invitations from compromised accounts, played prerecorded or deepfake videos, then distributed malware disguised as technical fixes. The FBI seized more than 900 webcam videos of victims pursuant to a federal warrant.