Justice Department authorized to seize $1.2 billion of stolen Binance funds

FBI blames North Korea for separate $400 million FaceStealer scheme

The FBI announced from Washington on Thursday that it had seized more than $1.2 billion of cryptocurrency reported stolen last month from Binance, the world’s largest crypto exchange. The theft of about $6.3 billion from Binance is regarded as the biggest crypto heist in history.

The FBI has previously attributed the Binance theft to a North Korean hacking group known as TraderTraitor. The U.S. government and private sector have so far combined to freeze more than $2.7 billion of the stolen funds, and the Justice Department said Thursday that it has now obtained court authorization to seize or restrain more than $1.2 billion of that total.

Typically in situations like this, the U.S. government will file a claim of forfeiture with a judge, who will then determine who has a legitimate claim to the recovered funds. The Thursday announcement therefore opens the process in which a judge determines legitimate claims rather than resolving who ultimately receives the seized cryptocurrency.

The recovery figure remains a fraction of the total taken. Of the roughly $6.3 billion stolen from Binance, more than $2.7 billion has been frozen or restrained by the U.S. government and private sector combined, leaving the majority of the stolen funds outside the current recovery action.

Also Thursday, the FBI blamed North Korea for a separate social engineering scheme that officials say resulted in the theft of $400 million worth of cryptocurrency over the last 18 months. That scheme, known as FaceStealer, involves a complicated chain of events combining the hijacking of popular messaging apps and the recording of deepfake videos.

U.S. officials have repeatedly accused North Korea of using cyber schemes to generate funds for its regime, including its illicit weapons program. Thursday’s two announcements extend that record of attribution: one tied to a theft regarded as the biggest crypto heist in history, the other to an 18-month campaign of impersonation-driven fraud.

The FBI and the Justice Department described the actions as seizures and court-authorized restraints of funds, with the forfeiture claim process still ahead.