U.S. Prosecutors Win Authority to Seize $1.2 Billion From the Binance Theft and Take Down a North Korean Deepfake Operation

The U.S. Department of Justice (DOJ) said on November 12 that courts had authorized it to seize or restrain more than $1.2 billion connected to the October 29 theft from Binance. The Federal Bureau of Investigation (FBI) attributes that theft to TraderTraitor, a North Korean state hacking unit. CryptoSlate's reading of the release is that the orders cover part of more than $2.7 billion already frozen, so the money is not newly recovered, and that the DOJ gave no timetable for getting it back to victims.

The private sector did most of the freezing. The Block reports that Tether, Ripple, Circle, World Liberty Financial and Arbitrum helped lock the funds, which works only on tokens an issuer or governance body can blacklist. The DOJ did not say how much of the frozen total is bitcoin. Bitcoin is the asset no issuer can freeze.

Binance's internal investigation attributes the theft to social engineering. The exchange said attackers compromised a DevOps engineer's laptop, reached a service container, and issued unauthorized withdrawal requests, and it found no evidence that private keys were leaked. Binance puts the loss at about $6.3 billion. Blockchain analysts traced the outflows across about ten blockchains, most of them within roughly 20 minutes.

Authorities also seized cloud infrastructure behind a separate scheme the FBI calls FaceStealer, according to CyberScoop. The FBI says North Korea-linked operators ran it for 18 months and took more than $400 million. They lured targets into video meetings that used recorded footage of earlier victims or deepfakes of well-known crypto figures. Agents seized more than 900 webcam recordings of victims. The BWE News wire summarized the DOJ website as tying FaceStealer to the Binance attack. Kim Yo Jong, sister of North Korean leader Kim Jong Un, denied North Korean involvement. Rekt News has published its own write-up of the Binance breach.