DOJ Secures Authority to Seize $1.2 Billion in Stolen Binance Crypto

The U.S. Department of Justice (DOJ) announced on Thursday that it has received court authorization to seize or restrain more than $1.2 billion in cryptocurrency tied to a significant theft from the Binance exchange. This development is part of a broader, collaborative effort by government and private-sector entities to freeze over $2.7 billion in stolen assets, which officials estimate halted approximately half of the funds taken during an October breach. While many users search for DOJ explained, this specific legal action represents a critical step in the government's ongoing efforts to track and recover illicit virtual assets.

The DOJ has obtained legal authority to seize $1.2 billion in cryptocurrency stolen by North Korean hackers.

According to the FBI, the theft was orchestrated by North Korean military actors identified as TraderTraitor, who allegedly stole over $6 billion in virtual assets from Binance on or around October 29. Binance has stated that it has already covered the losses for its users through its own insurance funds and treasury, ensuring that no individual customer was left at a loss. The DOJ’s current efforts are focused on interdicting the stolen funds, which are currently frozen at various token issuers. The $1.2 billion figure represents assets that the government can now move to formally forfeit.

Tracking the stolen assets

Despite the significant freezes, the investigation remains active. The DOJ reported that the perpetrators continue to move stolen assets through various cryptocurrency mixers, bridges, and exchanges. Investigators, including the FBI, the U.S. Secret Service, and the IRS Criminal Investigation division, are continuing to trace these funds. A recent Cyber Alert urged virtual asset service providers to block transactions linked to addresses associated with these actors, noting that the stolen assets have been primarily converted into ether.

Separately, the FBI and the U.S. Attorney’s Office in the Central District of California announced the dismantling of cloud-based infrastructure used in a social engineering campaign dubbed FaceStealer. This operation, which has resulted in the theft of $400 million over the past 18 months, uses deepfake technology and fake video calls to compromise targets and install malware. The FBI has seized over 900 webcam videos related to this campaign.

Why it matters

The actions taken by the DOJ highlight the ongoing challenges posed by state-sponsored cyber theft, which officials say is used to bankroll illicit weapons programs. By disrupting these financial flows and seizing infrastructure used for social engineering, the U.S. government aims to limit the resources available to these actors. For the global crypto community and investors, these events underscore the persistent security risks associated with digital asset storage and the importance of vigilance against sophisticated phishing and deepfake-based cyber attacks.