The US Department of Justice has secured court authorisation to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance in a major cyberattack attributed to North Korean hackers.
The action follows the October 29 attack, in which a North Korean military-linked hacking group known as TraderTraitor stole more than $6 billion in digital assets from the cryptocurrency exchange, according to the Justice Department.
In an announcement on November 12, the department said coordinated efforts involving US law enforcement agencies and private cryptocurrency companies had frozen more than $2.7 billion of the stolen funds.
More than $1.2 billion of that amount is now covered by court-authorised seizure or restraint orders. Authorities are continuing efforts to trace, freeze and recover the remaining assets.
How the US is tracking the stolen Binance funds
The hackers have continued moving the stolen cryptocurrency through different platforms and blockchain networks in an attempt to conceal its origin.
According to the Justice Department, TraderTraitor has been laundering the assets through cryptocurrency bridges, mixers and exchanges.
These services can make it harder for investigators to track funds across blockchain networks and identify the wallets controlled by the hackers.
The FBI has been working with the US Secret Service, the Internal Revenue Service’s Criminal Investigation division and private virtual asset service providers to identify and block transactions connected to the stolen assets.
The FBI previously issued a cyber alert identifying cryptocurrency addresses linked to the operation and urged exchanges and other service providers to block transactions to and from them.
US authorities say North Korean hackers have repeatedly stolen cryptocurrency to generate revenue for the country’s government and support its prohibited weapons programmes.
US also disrupts North Korean crypto theft scheme
The Binance-related action was announced alongside a separate operation targeting a North Korean social engineering campaign known as FaceStealer.
The Justice Department said the campaign had resulted in more than $400 million in cryptocurrency theft over the previous 18 months.
Unlike conventional attacks that rely primarily on technical vulnerabilities, FaceStealer uses fake video meetings, stolen accounts and artificial intelligence-generated deepfake videos to deceive victims.
Hackers reportedly invite targets to video calls using accounts taken over from previous victims. During the meetings, they play prerecorded footage of familiar people or use deepfakes to make the calls appear legitimate.
They then introduce a fake technical problem and direct victims to a link or prompt that secretly installs malware on their devices.
Once installed, the malware can capture passwords, monitor screens, record keystrokes and provide attackers with access to cryptocurrency wallets and other systems.
The FBI said the campaign has increasingly targeted cryptocurrency professionals and open-source software developers. Authorities also obtained a warrant to seize more than 900 webcam videos recorded from victims.
The Justice Department said it had disrupted cloud infrastructure used to operate the FaceStealer campaign.
North Korea’s growing cryptocurrency theft operations
North Korean hacking groups have become a major concern for the global cryptocurrency industry because of their involvement in several large-scale digital asset thefts.
The TraderTraitor group, which the FBI links to North Korea’s military, has been associated with multiple cryptocurrency theft operations.
The latest Binance attack adds to concerns about the ability of state-backed hacking groups to steal large amounts of digital assets and move them across different blockchain networks before authorities can intervene.
Although the US has obtained authorisation to seize more than $1.2 billion, the recovery process is not complete. Investigators are still tracking the remaining stolen funds and working with cryptocurrency platforms to prevent further movement.
The operation represents a significant recovery effort, but it also highlights the challenges exchanges and law enforcement agencies face when responding to large-scale cryptocurrency theft.
Read also: CFTC approves tZERO subsidiary to operate derivatives exchange