The Department of Justice announced Thursday that it has obtained court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance by North Korean military actors known as TraderTraitor. On or about October 29, these actors stole more than $6 billion worth of virtual assets from the exchange. While this legal victory represents genuine progress—the freeze of more than $2.7 billion halted about half of what officials called this historic breach—the announcement reveals a troubling gap between what law enforcement can freeze and what it can ultimately recover.
The numbers themselves tell a cautionary tale. Binance reported on November 3 that approximately $2.85 billion in stolen assets had been frozen or intercepted, yet the DOJ's court authority covers only $1.2 billion of that amount. More critically, Assistant Attorney General A. Tysen Duva acknowledged that TraderTraitor actors continue moving the stolen assets through cryptocurrency bridges, mixers and exchanges. The October 31 FBI Cyber Alert, issued alongside the U.S. Secret Service and IRS Criminal Investigation, noted that investigators have seen the stolen assets converted primarily into ether—a conversion that complicates tracing and forfeiture efforts.
This ongoing movement of funds highlights a fundamental vulnerability in cryptocurrency enforcement. Court authority to seize frozen assets is merely a legal stepping stone toward forfeiture and ultimate ownership transfer—it is not the same as actually preventing theft or stopping criminals from laundering proceeds. While the FBI, Secret Service, and IRS Criminal Investigation continue their work alongside the FBI's Los Angeles Field Office, Cyber Division and Virtual Asset Unit, the very nature of blockchain technology means that bad actors can continue their operations faster than law enforcement can adapt.
The FaceStealer campaign announced Thursday compounds these concerns. North Korean hackers, including those known publicly as APT38 and BlueNorff, have stolen more than $400 million in cryptocurrency over the last 18 months through social engineering campaigns using fake video calls on imposter versions of Zoom, Microsoft Teams and Google Meet. The FBI seized more than 900 webcam videos of victims pursuant to federal warrant, yet these arrests represent past crimes, not prevention of future ones.
Principal Deputy Assistant Attorney General M. Scott Proctor stated that North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft. If this premise is true, then freezing $1.2 billion or even $2.7 billion matters little if North Korean actors simply develop new theft methods and continue their operations unabated. The DOJ has won important legal authority, but it must also push for meaningful regulation of cryptocurrency bridges, mixers and exchanges—the infrastructure that currently enables state-sponsored theft to continue even after law enforcement identifies it.