More Than $1.2 Billion in Binance Hack Assets Under U.S. Court Authorization
Key Facts
The U.S. Department of Justice said on November 12 that it had obtained court authorization to seize or restrict more than $1.2 billion in assets stolen from Binance, as part of broader efforts to trace and freeze the funds. The department said U.S. government and private-sector efforts had frozen more than $2.7 billion in stolen assets by that date. The amount covered by the court authorization is part of the total frozen funds, according to the department’s statement. The authorization gives authorities legal power to act on those assets, but does not mean the funds have been finally seized or returned to their owners. The FBI also announced a separate operation targeting the FaceStealer scheme, which was aimed at stealing cryptocurrency—two actions described by the Justice Department in the same statement.
U.S. Attorney General Jeanine Ferris Pirro said authorities had acted together to freeze the fraud, adding: "We moved immediately and worked together to stop this massive criminal fraud in its tracks." In the statement, Pirro said authorities had seized more than $1.2 billion in stolen assets, while the department described the action involving that amount as court authorization to seize or restrict the assets. The FBI said it had seized more than $1.2 billion in cryptocurrency reported stolen from Binance the previous month, according to The Associated Press. Government forfeiture proceedings typically begin with a claim filed with a judge, who determines which parties have a legitimate claim to the recovered funds, the agency reported. Freezing assets therefore does not settle ownership or complete their forfeiture, while legal proceedings remain part of the recovery process.
The Binance theft dates to around October 29, when North Korean military personnel stole virtual assets worth more than $6 billion, according to the Justice Department. The FBI refers to these actors as TraderTraitor. The department said efforts to trace, freeze and seize the assets and proceeds remain underway. It added that the attackers continue to launder money through cryptocurrency bridges, mixing services and trading platforms. The previous week, the department had cited a cyber alert issued by the FBI in coordination with the Secret Service and the Internal Revenue Service, urging virtual asset service providers to block transactions using or originating from addresses linked to the laundering of stolen funds.
In a separate operation, the Justice Department said cloud infrastructure for the FaceStealer scheme had been seized, while the FBI said the campaign stole more than $400 million in cryptocurrency during the 18 months before the November 12 announcement. The scheme, according to the department, uses secretly recorded videos and deepfake technology: attackers lure victims into fake video meetings, then persuade them to install malware by making them believe there is a technical problem. After compromising a device, attackers may be able to steal cryptocurrency or exploit the victim’s access to other computing infrastructure. The department said the campaign targeted workers in the cryptocurrency and Web3 sectors, and later expanded its focus to open-source software developers. The FBI announced that it had seized more than 900 video recordings from victims’ cameras under a federal warrant.
The Justice Department said some victims did not discover the theft of cryptocurrency or hijacking of social media accounts until several months later, and in some cases more than a year after the initial infection. It added that attackers used stolen accounts to invite targets to video meetings, recorded their cameras, then showed them prerecorded clips of previous victims or fake videos of people the targets knew to gain their trust. The FBI’s public alert about FaceStealer was posted on the Internet Crime Complaint Center’s website on November 12. Reuters reported, citing the agency, that the North Korean hacking group known as Sapphire Sleet or UNC1069 was behind the activity, and that it was separate from the group linked to the Binance hack. More broadly, the Justice Department said cryptocurrency theft funds the North Korean government and its illicit weapons program, while Binance told Reuters it was in close contact with regulators around the world and was keeping them informed about the hack.