DOJ moves to seize $1.2B from North Korea’s Binance hack

The U.S. Justice Department said on Nov. 12 that it has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance. The theft, which took roughly $6.3 billion, is the largest cryptocurrency heist on record, and the department blames it on North Korea. The $1.2 billion is part of more than $2.7 billion frozen so far through joint government and private-sector efforts, according to the department. Investigators are still chasing the rest of the money as the hackers try to move it out of reach.justice.gov

Bloomberg reported that Tether and Circle Internet Group, the two largest stablecoin issuers, froze the $2.7 billion soon after the Oct. 29 break-in. That puts almost half of the stolen funds out of the attackers' hands. The court orders cover part of that frozen amount and do not add to it, Nextgov noted.bloomberg.com+1

Laundering race

The FBI calls the hackers "TraderTraitor" and describes them as members of the North Korean military. The department said they "continue to launder such assets through various cryptocurrency bridges, mixers, and exchanges," and that efforts to trace, freeze, seize and forfeit the funds are ongoing, according to the Justice Department. The week before, the FBI issued a cyber alert asking crypto service providers to block transactions tied to addresses the group is using.justice.gov

A senior Justice Department official said the government now holds the funds covered by the orders. The official also said further recovery is getting harder because the hackers are breaking the money into smaller amounts and spreading it across laundering networks. "These actors have gotten very good at laundering," the official told Nextgov. Blockchain analytics firm Elliptic said North Korea's launderers have been creating worthless tokens of their own and running stolen assets through decentralized exchange liquidity pools, The Record reported.therecord.media+1

Assistant Attorney General A. Tysen Duva said the Criminal Division acted "to immediately halt about half of this historic breach," per The Record.therecord.media

Customers covered, recovery pending

Binance has said the attackers got into an engineer's computer through a fake job interview and then reached the systems that approve transfers, Nextgov reported. The exchange set aside $6.34 billion of its own funds to cover the losses. On Nov. 12 it said it had finished covering affected customer assets, according to The Block. Any return of the seized funds would generally require court proceedings to decide who owns them, and officials said it was too early to say how that process would work.nextgov.com+1

In the same announcement, the department said it had seized cloud infrastructure behind "FaceStealer." That North Korean campaign used fake video calls and recordings of past victims, and it has stolen more than $400 million over 18 months. Officials said it likely involved a different group of North Korean actors than the Binance theft, Nextgov reported.nextgov.com