Court-authorized seizure and restraint cover part of more than $2.7 billion frozen after the October attack. Authorities also disrupted a separate campaign using fake video meetings to steal cryptocurrency.
MARKET INSIDER — U.S. authorities have obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, marking a significant step in efforts to recover assets from the exchange’s October breach. The Justice Department said Thursday that government agencies and private-sector partners had frozen more than $2.7 billion following the theft of over $6 billion. The $1.2 billion is part of that frozen amount, rather than an additional recovery. Investigators continue tracing the remaining assets while pursuing a separate impersonation campaign that authorities say has stolen more than $400 million.
Key Highlights
- Court orders authorize the seizure or restraint of more than $1.2 billion within the broader $2.7 billion frozen total.
- U.S. authorities attribute the Binance attack to North Korean military-linked actors known as TraderTraitor.
- A separate operation targeted FaceStealer, a campaign using manipulated video meetings to compromise cryptocurrency holders.
A recovery milestone, with funds still being traced
The Justice Department’s November 12 announcement follows the October 29 theft from Binance, one of the largest security incidents in the cryptocurrency industry.
The FBI attributes the attack to TraderTraitor, a group that U.S. authorities link to the North Korean military. Investigators have been working with digital-asset service providers to identify and intercept funds as the attackers move them through cryptocurrency networks.
The latest announcement describes several stages of the recovery process. Freezing assets restricts their movement. Court-authorized seizure or restraint provides a legal basis to take custody of assets or maintain restrictions on them. Neither figure, by itself, establishes how much has ultimately been returned to Binance or affected users.
The distinction also prevents double counting: the more than $1.2 billion covered by court authorization sits within the more than $2.7 billion already frozen.
Authorities said efforts to trace, freeze, seize and pursue forfeiture of the stolen assets remain ongoing as the attackers continue attempting to launder the funds.
Separate crackdown targets fake video meetings
Alongside the Binance recovery effort, authorities seized cloud infrastructure used in a separate operation known as FaceStealer.
According to the Justice Department, that campaign has stolen more than $400 million in cryptocurrency over approximately 18 months. Its principal targets include people working in cryptocurrency and Web3.
The attackers exploit familiar professional relationships. Invitations arrive through compromised accounts, while stolen recordings and AI-generated deepfakes make video meetings appear to involve trusted contacts.
During a call, the attackers claim that a technical problem requires a software fix. The supposed remedy installs malware, allowing them to compromise the victim’s device, access communications and potentially steal digital assets.
The damage may emerge long after the initial meeting. Authorities described cases in which cryptocurrency theft and account takeovers occurred months, or more than a year, after the first compromise. Stolen contact lists then provide a route to additional victims.
The announcement treats FaceStealer and the Binance breach as separate operations. It does not establish that the video impersonation campaign caused the exchange’s October attack.
Trust becomes part of the security challenge
Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office, warned that FaceStealer can deceive technically experienced and security-conscious users because it exploits trust in video platforms and personal relationships.
That makes the campaign relevant beyond the immediate losses. Familiar faces and established accounts can no longer be treated as sufficient proof that a request is legitimate.
For cryptocurrency businesses, the incident illustrates how security risks extend beyond wallets and trading systems to employee devices, communications and access credentials. A compromised conversation can become an entry point into a much wider network.
What the enforcement action means for crypto markets
The Binance recovery effort demonstrates that stolen digital assets can sometimes be immobilized through coordination among investigators, exchanges and other industry participants.
However, the announcement also shows the limits of measuring progress through a single headline number. Assets identified, frozen, placed under court orders and ultimately returned represent different outcomes.
For investors assessing exchange security, the important questions now include how much of the remaining stolen cryptocurrency can be intercepted, how quickly legal proceedings advance and what operational changes follow the breach.
The Justice Department framed the actions as part of a broader effort to disrupt North Korea’s alleged use of cryptocurrency theft to finance its government and weapons programs. For the digital-asset industry, the immediate task remains recovering funds while preventing compromised identities and infrastructure from enabling the next attack.
