U.S. seizes $1.2 billion in cryptocurrency stolen from Binance

U.S. Authorities secured court authorization to seize more than $1.2 billion in cryptocurrency stolen from Binance, delivering a major blow to state-sponsored North Korean cybercrime syndicates.

The legal action follows a massive security breach at Binance that occurred on or around 29 October, according to statements from the U.S. Department of Justice. The Department of Justice stated that members of the North Korean military, tracked by the Federal Bureau of Investigation under the moniker "TraderTraitor," drained billions of dollars in virtual assets. Blockchain intelligence firm TRM Labs characterized the breach as the largest cryptocurrency theft on record, surpassing the Bybit hack from February 2025, according to ITWeb.

Media additions

Following the breach, collective interdiction efforts involving U.S. Government agencies and private-sector virtual asset service providers succeeded in freezing over $2.7 billion of the stolen funds. As Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division noted, authorities managed to quickly halt about half of the historic breach before the funds slipped beyond law enforcement reach.

Despite these interventions, recovery operations remain complex. Investigators report that TraderTraitor actors continue laundering the remaining digital assets by routing them through cross-chain bridges, mixers, and exchanges. The FBI published a list of approximately 500 Ethereum addresses utilized by the hackers, urging cryptocurrency platforms and blockchain analytics firms to block any transactions connected to those wallets.

Concurrently, federal authorities disrupted cloud-based infrastructure tied to a separate North Korean social engineering operation known as "FaceStealer." Operating over an 18-month window, this campaign resulted in more than $400 million in cumulative cryptocurrency thefts. The scheme relied on compromised accounts to send invites for fake video meetings hosted on imposter versions of popular platforms such as Zoom, Microsoft Teams, and Google Meet. Attackers deployed prerecorded webcam footage of acquaintances or AI-generated deepfakes of prominent crypto figures, subsequently manufacturing technical errors that tricked targets into installing malware.

Patrick Grandy, assistant director in charge of the FBI's Los Angeles Field Office, warned that the social engineering tactics are sophisticated enough to deceive seasoned technical professionals. Investigators executing a federal warrant also recovered more than 900 webcam videos of victims, noting that the campaign increasingly targets open-source software developers in an attempt to infiltrate software supply chains.

Official statements connected both malicious campaigns to state survival strategies. M. Scott Proctor, principal deputy assistant attorney general for the National Security Division, emphasized that the North Korean government bankrolls its rogue regime and illicit weapons programs through cryptocurrency theft.

Meanwhile, the exchange itself has addressed the aftermath through distinct financial mechanisms. According to Bitcoin Magazine, Binance covered the user-facing losses by replacing the stolen tokens directly from its treasury, the Secure Asset Fund for Users, and its futures insurance fund, establishing a clean separation between corporate restitution and ongoing government forfeiture proceedings.

As the legal and technical fallout unfolds, investigative bodies including the Secret Service and the Internal Revenue Service Criminal Investigation division continue tracing illicit movements across the blockchain.