Key Takeaways
- Government and private-sector efforts froze more than $2.7 billion.
- The theft exceeded $6 billion, U.S. authorities said.
- Launderers moved stolen assets through nearly 27,000 wallets.
Court Orders Target More Than $1.2 Billion
The U.S. Department of Justice (DOJ) announced on Nov. 12 that it had obtained court authorization to seize or restrain stolen Binance assets worth more than $1.2 billion. Those funds were part of more than $2.7 billion frozen through coordinated government and private-sector efforts. The department attributed the theft of more than $6 billion around Oct. 29 to North Korean military hackers.
Principal Deputy Assistant Attorney General for National Security M. Scott Proctor said:
“The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.”
The department linked North Korea’s cryptocurrency thefts to financing its government and illicit weapons program. Seizure places assets under government custody or control; restraint restricts their transfer while proceedings continue.
The same Nov. 12 announcement also covered Facestealer, a separate North Korean scheme that used secretly recorded videos and deepfakes to target people in the cryptocurrency and Web3 sectors. According to the DOJ, the scheme stole more than $400 million over 18 months, and the FBI seized cloud infrastructure behind it and more than 900 webcam videos of victims.
Binance said on Nov. 12 that it had completed coverage of affected assets after committing more than $6.34 billion in company funds to cover the losses. The exchange also published a reserve snapshot covering 198 tokens. It captured balances at midnight UTC that day.
FBI Sought Blocks on Theft-Linked Transactions
In an Oct. 31 alert, the Federal Bureau of Investigation (FBI) attributed the Binance theft to Tradertraitor, its designation for the North Korean hacking activity. Working with the U.S. Secret Service and IRS Criminal Investigation, the bureau observed attackers converting stolen assets primarily into ether. It expected further laundering through decentralized finance and instant-swap services, which exchange one cryptocurrency for another.
Authorities urged exchanges, infrastructure operators, and other digital asset businesses to block transactions involving or derived from identified addresses. North Korea denied responsibility for the Binance hack on Nov. 3. Kim Yo-jong, the sister of North Korean leader Kim Jong Un, rejected the FBI’s attribution in a statement carried by state media.
Investigators were pursuing funds moving through bridges that transfer assets between blockchains, mixers, and exchanges, according to the DOJ. The department said tracing, freezing, seizure, and forfeiture work remained underway as the attackers continued laundering the assets.
Laundering Network Complicates Recovery
Blockchain analytics firm Elliptic, which traces cryptocurrency transactions to identify illicit activity, tracked conversions of stolen solana, XRP, and tron into bitcoin. Its Nov. 13 update counted nearly 27,000 wallets, at least 16 blockchains, at least 36 services, and more than 83,000 transactions across the laundering operation.
The firm also identified meme coins used to disguise Binance theft proceeds on Tron, Solana, and Near. Newly created tokens featured in the Tron and Near activity, while the Solana tactic involved existing assets. Trading through token liquidity pools allowed stolen funds to pass between wallets without a direct transfer linking the sender and recipient.
Elliptic’s update covering Nov. 11-13 described light activity beyond further XRP swaps. Converted proceeds had reached roughly 4,100 bitcoin, valued at $285 million at the time. Its mixing estimates included roughly 11,000 ether in laundering-linked deposits into Tornado Cash.
