U.S. court orders cover part of the cryptocurrency already immobilized through coordinated industry intervention. Binance says it has fully covered affected customer assets, shifting attentio
The U.S. Justice Department announced court-authorized action involving more than $1.2 billion in cryptocurrency stolen during North Korea’s October attack on Binance, marking a major enforcement development in the largest known cryptocurrency theft.
In its November 12 announcement, the department said coordinated efforts had frozen more than $2.7 billion and that the assets covered by its seizure or restraint orders formed part of that amount.
The action follows an attack estimated at approximately $6.3 billion, which the FBI attributed to North Korea’s TraderTraitor operation. Authorities also disclosed the disruption of FaceStealer, a separate campaign using manipulated identities and recorded video calls to compromise victims.
For Binance customers, the financial situation has already changed. The exchange reported on November 12 that it had completed coverage of affected customer assets using its own resources and protection funds. That replacement process is distinct from the government’s efforts to recover the original stolen cryptocurrency.
The Justice Department’s figures describe two stages of intervention.
Stablecoin issuers, exchanges and blockchain investigators initially worked to prevent stolen assets from moving through cryptocurrency networks. Federal authorities subsequently obtained court authorization to seize or restrain a portion of the identified funds.
The government action therefore cannot be added to the industry-wide freeze total as a separate recovery.
What Happens to Recovered Crypto? Three stages of asset recovery under U.S. enforcement 01 / FROZEN Transfers blocked An issuer or platform prevents identified assets from moving. Victim access: No automatic claim 02 / SEIZED Legal control Authorities obtain control or court-authorized restraint over identified property. Victim access: Further proceedings required 03 / FORFEITED Distribution possible A completed forfeiture can make assets available for eligible compensation processes. Victim access: Subject to eligibility Source: U.S. Department of Justice asset forfeiture and victim compensation guidance.Chainalysis previously documented how quickly the attackers attempted to escape issuer-controlled stablecoins. Its investigation of the Binance exploit identified a sequence in which $325 million in stablecoins was exchanged for approximately $285 million in ETH over nearly 20 minutes.
The attackers sacrificed value to acquire an asset that could not be frozen directly by a stablecoin issuer.
Investigators also identified automated laundering patterns, including repeated transactions through newly funded wallets. Some addresses initially received exactly 1 TRX before processing additional transfers, suggesting a scripted approach to distributing the proceeds.
The FBI’s October 31 TraderTraitor alert published Ethereum addresses associated with the operation, including:
For compliance teams, those identifiers provide a starting point for transaction screening. Investigators must still assess transaction histories and counterparties to distinguish direct exposure from incidental transfers.
Binance’s response changes who may ultimately have a financial claim against recovered assets.
The exchange initially used corporate reserves, its Secure Asset Fund for Users (SAFU) and a portion of its futures insurance reserves to replace stolen holdings.
Its November 4 recovery update reported that approximately 98% of affected assets had been replenished, with the remaining purchases involving less-liquid tokens.
The company subsequently said that coverage was complete, although its latest proof-of-reserves verification remained pending.
Customers whose balances have been restored generally would not have an outstanding loss equal to the amount already reimbursed. Binance or other parties that actually absorbed the financial damage may therefore have a stronger economic interest in any subsequent recovery.
That does not automatically establish their legal entitlement to forfeited assets. The applicable ownership records, court orders and compensation rules will determine who qualifies.
The DOJ’s victim-compensation guidance explains that remission petitions typically require proof of a direct financial loss, supporting records and disclosure of compensation already received.
An authorized seizure is only one step. A forfeiture proceeding and any applicable victim-compensation process must address the ultimate disposition of the property.
The Justice Department also announced the disruption of FaceStealer, a North Korean operation that allegedly stole more than $400 million in cryptocurrency over an 18-month period.
According to the government’s account, investigators seized more than 900 recorded victim videos associated with the scheme.
Attackers used deepfake technology and previously captured recordings to impersonate people their targets already trusted during live calls.
Some compromises were exploited only after lengthy delays, including cases in which operators waited more than a year before stealing assets.
That approach undermines a common assumption in corporate security: that seeing and hearing a familiar colleague is sufficient evidence of identity.
A recording obtained during an ordinary business meeting can become material for a later impersonation attempt. An attacker may use it to support a request for software installation, privileged access or transaction approval long after the original interaction.
The delay also complicates incident investigations because the initial social-engineering event may appear unrelated to the eventual theft.
The operational response should focus on authorization controls that remain effective when an attacker can reproduce a person’s appearance and voice.
Treasury teams handling high-value transfers should require hardware-backed authentication, independently verified transaction details and multisignature approvals where appropriate.
FIDO2 or WebAuthn security keys can help protect account authentication, while hardware-wallet or institutional signing systems can verify transaction-specific approvals. These are separate controls and should be deployed together where the risk warrants it.
A video call may still be useful for communication, but it should never be the sole basis for authorizing a sensitive transfer.
Security teams should also review dormant privileged access and unusual software deployments. FaceStealer’s reported delays show why monitoring only the hours immediately following a suspicious interaction can miss an attacker’s eventual objective.
Court-authorized restraint can prevent assets from being moved while investigators pursue forfeiture or related legal proceedings.
The next steps may include civil forfeiture filings, challenges from parties claiming an interest in the assets and decisions about their eventual distribution.
For Binance, the outcome could determine how much of the financial burden absorbed through corporate and protection reserves is ultimately recovered.
The exchange has separately committed to restoring SAFU to approximately $1 billion. Its final funding position and any recovery through U.S. legal proceedings remain distinct accounting questions.
Anyone approached by an alleged recovery agent should verify the communication through the Justice Department or FBI Internet Crime Complaint Center. Government victim-compensation petitions do not require advance recovery fees.
The post DOJ Seizes $1.2B in Binance Hack Funds Tied to North Korea appeared first on ETHNews.
