- The Justice Department said it obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance last month, CNBC reported, citing a Thursday announcement. Over $6 billion was stolen from the exchange on Oct. 29, an attack the department attributed to actors linked to the North Korean military, a group the FBI refers to as “TraderTraitor.”
- Collective efforts by the U.S. government and the private sector have now frozen more than $2.7 billion of that amount, CNBC said. Using those figures, about 45% of the more-than-$6-billion total has been frozen, and the newly seized or restrained $1.2 billion is about 20% of the stolen total, by our calculation. Officials said efforts to track and freeze the assets are continuing, as the actors keep laundering them through various cryptocurrency channels.
- The department framed the action as part of a broader campaign against North Korean schemes “to fund its regime through the massive theft of cryptocurrency.” Principal Deputy Assistant Attorney General for National Security M. Scott Proctor said the National Security Division “will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.”
- Authorities also disrupted cloud infrastructure used in a separate identity-impersonation scam known as FaceStealer, which the DOJ said has stolen more than $400 million in cryptocurrency over 18 months. In that scheme, hackers set up fake video meetings using stolen accounts and AI-generated deepfakes, trick the target into installing malware, then steal crypto and go after the victim’s contacts, sometimes months or more than a year later. FBI Assistant Director in Charge Patrick Grandy called it “a highly effective social engineering scheme” that “exploits our trust in ubiquitous video conference platforms.”
What Happened?
The Oct. 29 Binance hack was already a confidence shock for crypto market security, and it was cited on Friday in CNBC’s market coverage as one of the factors weighing on bitcoin alongside dollar strength and ETF outflows. A seizure-and-freeze total above $2.7 billion is a large recovery relative to most prior hacks, but more than half of the stolen funds, on the figures given, remains at large, and the department itself said the laundering is ongoing. The FaceStealer takedown is a separate, smaller-dollar case, but it underscores the same theme: AI-enabled social engineering aimed at crypto professionals.
Why It Matters?
For digital-asset markets, the announcement is a reminder that North Korean theft remains a systemic security risk and that U.S. agencies are now willing to advertise multi-billion-dollar recoveries. It does not, by itself, reverse a market already selling off on rates and risk appetite, but it may matter for how exchanges and custodians talk about recovery and controls. The attribution to TraderTraitor also keeps the hack in the national-security, not merely criminal, bucket.
What’s Next?
Watch whether additional freezes are announced as the laundering trails are followed, whether Binance or other exchanges recover funds for customers, and whether the FaceStealer disruption leads to arrests or further infrastructure seizures. Bitcoin’s slide below $70,000 on Friday will also test whether a high-profile recovery can offset the residual security overhang from a $6 billion exchange hack.
Affected Tickers and Coins: Bitcoin
Source: CNBC
