The DOJ Binance seizure marks a major legal escalation in the effort to recover virtual assets that the FBI attributes to North Korea. The Justice Department said on Thursday, November 12, that it had obtained court authority to seize or restrain more than 1.2 billion dollars of cryptocurrency stolen from Binance. The action covers part of a wider freeze of more than 2.7 billion dollars and could allow US authorities to pursue forfeiture of the assets. The underlying court papers were not posted with the announcement.
DOJ Binance seizure: From freeze to forfeiture
The newly authorized 1.2 billion dollars is not newly recovered money. It comes from the roughly 2.85 billion dollars that Binance said on Nov. 3 had been frozen or intercepted. Until the court action, those funds were frozen at token issuers. The authorization is the legal step that lets the government move toward taking ownership through forfeiture, although the DOJ did not report a sale or completed return of the assets.
Bitcoin Magazine reported that the DOJ also gave no amount, date or method for returning anything to Binance or its customers. TokenPost likewise noted that the authorization does not establish that the full amount has been seized or returned. The distinction matters for market participants. A freeze can prevent an asset from moving, while a court-authorized seizure or restraint places it under government control as forfeiture proceedings proceed.
Assistant Attorney General A. Tysen Duva of the DOJ’s Criminal Division said the department and its partners had immediately halted about half of the historic breach by freezing stolen assets before they moved beyond law enforcement reach. The more than 2.7 billion dollar total represents a joint effort by US government agencies and private-sector participants. It is therefore broader than the portion covered by the court authorization.
What was taken from Binance
The DOJ said members of the North Korean military, whom the FBI refers to as TraderTraitor, stole more than 6 billion dollars worth of virtual assets from Binance on or about Oct. 29. That reported loss is below the 6.34 billion dollars Binance has covered since the attack. Bitcoin Magazine reported that Binance replaced the affected tokens from company funds rather than recovering the stolen coins, drawing a distinction between the exchange’s reimbursement effort and the law enforcement recovery process.
The FBI’s Oct. 31 Cyber Alert attributed the theft to North Korea and urged virtual asset service providers to block transactions involving, or derived from, addresses used by the actors. The alert said investigators had observed the stolen assets converted primarily into ether. The DOJ did not disclose a token-by-token breakdown for the 1.2 billion dollars covered by its court authorization, and it did not say how much of either the wider freeze or the authorized amount is bitcoin.
The recovery effort remains active. The DOJ said TraderTraitor actors are still moving stolen assets through cryptocurrency bridges, mixers and exchanges. Tracing, seizure and forfeiture work continues, with the FBI’s Los Angeles Field Office, Cyber Division and Virtual Asset Unit coordinating the recovery effort alongside the US Secret Service and IRS Criminal Investigation. Decrypt reported that North Korea has been laundering the proceeds rapidly, creating a new wallet roughly every 25 seconds. North Korea has denied involvement and called the FBI’s finding a political provocation.
FaceStealer expands the exposure
Separately, the US attorney’s office in the Central District of California and the FBI announced the seizure of cloud-based infrastructure used in FaceStealer, a social engineering campaign. The FBI said the scheme had resulted in theft of more than 400 million dollars in cryptocurrency over the last 18 months. It has also been used in attempts to compromise people who maintain open-source software, which the bureau said appears calculated to enable supply-chain attacks.
FaceStealer turns a conventional video meeting into an attack. North Korean hackers, publicly known under names including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima, lure targets with meeting invitations sent from accounts stolen from earlier victims. Once a target joins, the hackers record the target’s webcam and play prerecorded footage of a person the target knows. They also create deepfakes of well-known figures in the cryptocurrency industry to build trust.
The attackers then introduce a fake technical error, such as claiming that the target cannot be heard, and provide a link or prompt intended to fix it. The supplied fix installs malware, giving the attackers access to cryptocurrency or other systems. In several cases, theft occurred months to more than a year after the initial compromise because the actors waited for wallet balances to grow. A Thursday FBI FLASH report said meetings operated through imposter versions of Zoom, Microsoft Teams and Google Meet, with invitations often moving through hijacked Telegram, LinkedIn, Slack or Discord accounts.
Why the market should care
Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims. Principal Deputy Assistant Attorney General for National Security M. Scott Proctor tied both actions to the claim that North Korea’s government bankrolls its regime and illicit weapons program through cryptocurrency theft. The wording matters because it reflects the government’s case rather than a judicial determination on every allegation raised by the operation.
For digital-asset markets, the immediate signal is that stolen funds can cross from a private theft response into a formal forfeiture process. The limitation is equally important. The DOJ Binance seizure does not mean 1.2 billion dollars has been returned, sold or credited to Binance customers. It establishes court authority over that amount, while the larger freeze depends on continued cooperation among agencies, token issuers and private-sector participants.
The FaceStealer action points to a broader security risk for crypto companies and software developers. Compromised personal accounts can become channels for further attacks, while convincing video impersonation can bypass familiar security habits. The DOJ Binance seizure therefore matters beyond the reported value of the frozen assets. It shows the enforcement system moving deeper into both the financial rails and the infrastructure used by North Korean-linked actors, although the DOJ Binance seizure remains a legal milestone rather than a completed recovery.