US secures court authority over $1.2bn in Binance theft

The Justice Department said Thursday, November 12, that it had secured court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance in an October attack. The FBI and other US agencies have worked with crypto firms to freeze the funds, according to the Justice Department announcement.

• The theft took place on or about October 29, according to the department.
• US government and private-sector efforts have frozen more than $2.7 billion of the stolen assets.
• The court-authorized amount is more than $1.2 billion of that total.

The distinction matters: court authorization to seize or restrain assets is not the same as a final decision on who receives them. The Associated Press reported that the government typically files a forfeiture claim with a judge, who then decides who has a legitimate claim to recovered funds. The Justice Department said efforts to trace, freeze, seize and forfeit the assets are ongoing.

The department said North Korean military members, whom the FBI calls TraderTraitor, stole more than $6 billion in virtual assets from Binance. In an October 31 alert, the FBI attributed the theft to North Korea and said the group had been converting stolen assets primarily into Ether. The Justice Department’s November 12 announcement said the actors continue to move assets through cryptocurrency bridges, mixers and exchanges.

The FBI’s alert urged virtual-asset service providers, including instant exchanges and decentralized finance services, to block transactions involving addresses linked to the activity, including funds derived from those addresses. The FBI published a list of addresses it said held or had held assets from the theft. That request shows how recovery efforts depend in part on firms and services identifying and stopping transfers as funds move between platforms and networks.

For Binance users, the announcement concerns assets stolen from the exchange, not a stated payment to customers. The Justice Department release does not say how much of the $1.2 billion has been physically transferred into government custody, or how long the legal process will take. The AP report described the FBI as saying the US had seized more than $1.2 billion, while also noting that the department had obtained court authorization to seize or restrain that amount. The department’s own wording is more specific about the court action.

The recovery effort is part of a wider US response to the theft. The Justice Department said several federal offices and law-enforcement partners worked with virtual-asset service providers to freeze the funds. It said the FBI’s Los Angeles Field Office, Cyber Division and Virtual Asset Unit are coordinating recovery work with the US Secret Service and IRS Criminal Investigation.

The same November 12 release announced a separate action involving FaceStealer, a social-engineering scheme the FBI says North Korean hackers used to steal more than $400 million in cryptocurrency over 18 months. The department said it seized cloud infrastructure used in that scheme. That action is separate from the Binance recovery, which concerns funds stolen in October and remains ongoing.

Sources and documents

• Justice Department announcement — justice.gov
• FBI attributed the theft to North Korea — fbi.gov