More Than $2.7 Billion Frozen in Binance Hack Case; Court Authorization Covers More Than $1.2 Billion
Key Facts
On November 12, the U.S. Justice Department obtained court authorization to forfeit or restrict more than $1.2 billion in cryptocurrency stolen from Binance, a step in the asset-recovery process that does not mean the funds have been fully forfeited. The department said U.S. government and private-sector efforts had jointly frozen more than $2.7 billion in stolen funds as of that date. The amount covered by the court authorization is part of the total frozen funds, according to the department’s statement, distinguishing the legal action from recovering the funds or returning them to their owners. The Associated Press said the government typically files a forfeiture claim before a judge, who then determines which claimants have a legitimate right to recovered funds. Authorities continue to track and freeze assets and seek their forfeiture, while money-laundering efforts linked to the attack continue.
The case dates to an incident on or around October 29, when Binance said about $6.34 billion in digital assets were affected. The Federal Bureau of Investigation estimated the value of the stolen funds at more than $6 billion and attributed the operation to North Korea, naming the cyber activity TraderTraitor. Binance’s figure for affected assets differs from the amount authorities said was stolen, while the total frozen by government and private-sector efforts measures frozen funds, not compensation paid to customers. In an update published on November 3, the company said about $2.85 billion had been frozen or intercepted. These figures reflect different stages in the response: estimates of affected assets, followed by freezing and interception, then forfeiture or restriction proceedings that require a judicial process.
According to Binance’s report, the attack began with the exploitation of unauthorized access to an internal wallet-signing service, enabling the attackers to initiate transactions outside the usual withdrawal process. Between 20:05 and 20:09 UTC on October 29, five hot wallets belonging to the platform sent 233.46 million XRP to an address controlled by the attacker. The company said this activity took place within a short window as part of a mechanism targeting hot wallets. The incident’s account describes how assets were moved from the platform’s infrastructure to an external address, while subsequent measures focus on tracking the funds and halting their movement. The FBI attributed the attack to North Korea and said entities linked to TraderTraitor converted the stolen assets primarily into Ether.
The FBI warned that entities linked to the operation could use decentralized finance services and instant-swap services in later stages of money laundering. It urged virtual asset service providers to block transactions linked to addresses used by the attackers. In its statement, the Justice Department said asset laundering was continuing through cryptocurrency bridges, mixers and platforms, alongside efforts to track, freeze and forfeit the assets. This means the announced freeze does not necessarily end the movement of funds, and tracking remains part of ongoing enforcement measures. The department said proceeds from cryptocurrency theft fund North Korea’s illicit weapons program, describing cryptocurrency as an area Pyongyang exploits for fraud and to finance its activities.
In its November 3 update, Binance said it had allocated more than 100% of the funds needed to cover the loss. It added that 98% of affected assets had been reimbursed as of October 31. That figure concerns what the company said it had reimbursed to users, while the frozen-funds figure covers what government and private-sector efforts have stopped; the two percentages therefore do not measure the same thing. Binance also said the investigation was ongoing and that the findings of its preliminary report would undergo further independent review. The company’s statement did not change the status of U.S. judicial proceedings involving the frozen funds or authorities’ efforts to track assets that remain subject to laundering.
The Justice Department said efforts to track, freeze and forfeit the funds, and to pursue their forfeiture, were ongoing, while entities linked to TraderTraitor continued to move assets through different services and platforms. Under the customary procedures described by the Associated Press, the government will file a forfeiture claim with a judge, who will later decide who has a legitimate claim to the recovered funds. In a parallel action, the department announced the disruption of cloud infrastructure used in the FaceStealer campaign and said the campaign stole more than $400 million in cryptocurrency over 18 months. It said the FBI seized more than 900 video recordings of campaign victims under a federal warrant. The department linked the campaign to luring targets into video meetings through stolen accounts, using recordings or fake clips to impersonate trusted people, and then persuading victims to install malware under the pretext of fixing a technical problem.