FACTS
The U.S. Justice Department said Thursday, Nov. 12, that it has obtained court authorization to seize or restrain more than $1.2 billion in stolen Binance crypto, part of more than $6 billion taken from the exchange on or about Oct. 29. The FBI attributes the theft to North Korean military hackers it calls “TraderTraitor,” according to the Justice Department. The department also announced the disruption of cloud infrastructure used in a separate North Korean scheme the FBI calls “FaceStealer.”
This story follows Stay Current News’ earlier report on the Binance breach.
What officials said about the stolen Binance crypto
“Collective U.S. government and private sector efforts so far have resulted in the freeze of more than $2.7 billion,” the Justice Department said, adding that it obtained court authorization to seize or restrain more than $1.2 billion of that amount. The release does not say how much of that has been seized outright and how much restrained.
The Associated Press, in a report published by SecurityWeek, said the theft of about $6.3 billion is “regarded as the biggest crypto heist in history.” Binance has put the estimated total impact at approximately $6.3 billion, Fox Business reported.
“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, principal deputy assistant attorney general for national security. U.S. Attorney Jeanine Ferris Pirro of the District of Columbia said, “The North Korean regime may think they are sophisticated cyber criminals, but we have consistently met them head on.”
Who officials say is behind the theft
The Justice Department describes TraderTraitor as members of the North Korean military. The FBI and Secret Service blamed the group in messages over the weekend after the theft, The Record reported. A joint FBI, Secret Service and IRS cyber alert urged crypto firms to block transactions tied to the laundering addresses, according to The Korea Times.
North Korea has denied involvement. In a statement carried by the Korean Central News Agency, Kim Yo Jong, sister of leader Kim Jong Un, said “the US assertion is an absurd rhetoric and nothing new,” Cointelegraph reported. She called the attribution a politically motivated provocation and suggested the United States could have been behind the theft, offering no evidence, Cointelegraph reported.
How the funds were traced and frozen
Authorities worked with virtual asset service providers to freeze the assets, and TraderTraitor actors continue to launder the funds through “various cryptocurrency bridges, mixers, and exchanges,” the Justice Department said. Investigators are following the crypto through those channels to freeze and recover more, CoinDesk reported.
Private companies also froze funds early on. As Stay Current News reported on Oct. 31, Circle CEO Jeremy Allaire said Circle froze more than $800 million equivalent, and Tether CEO Paolo Ardoino said Tether froze more than $1.5 billion equivalent.
What happens to the seized funds
“Typically in those situations, the U.S. government will file a claim of forfeiture with a judge,” the AP reported, and the judge then decides who has a legitimate claim to the recovered money. The Justice Department said efforts to trace, freeze, seize and forfeit the assets are ongoing. Its release does not say when or how any money would go back to Binance or its users.
Binance said in a Nov. 12 post on X that it “has completed coverage of assets impacted in the security incident,” crypto.news reported. The exchange said that once a zero-knowledge proof is generated, “users can independently verify that their assets are backed at a minimum of 1:1.” Co-CEO Richard Teng told Fox Business that customers would not bear losses.
Separate action on the FaceStealer scheme
The U.S. Attorney’s Office for the Central District of California announced the disruption of cloud-based infrastructure used in FaceStealer, which the FBI says caused more than $400 million in thefts over the last 18 months. The hackers lure targets into video meetings from accounts stolen from earlier victims, record their webcams and play prerecorded or deepfake videos of trusted contacts and use a fake technical error to get them to install malware, the department said. The FBI seized more than 900 webcam videos of victims under a federal warrant.
Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office, said the scheme “exploits our trust in ubiquitous video conference platforms.”
More coverage is in the Stay Current News Money section.
Photo: File photo of the J. Edgar Hoover Building, FBI headquarters, in Washington, D.C. Carol M. Highsmith / Library of Congress, public domain.
