US authorities have obtained court authorisation to seize or restrain more than $1.2 billion in cryptocurrency allegedly stolen from Binance by North Korean hackers, the Department of Justice announced on Thursday.
The action follows a major cyberattack around October 29 in which hackers linked to North Korea’s military allegedly stole more than $6 billion in digital assets from the cryptocurrency exchange.
According to the Justice Department, the attack was carried out by a North Korean hacking group known as TraderTraitor, which authorities have linked to cryptocurrency theft and other cybercriminal activities.
The department said coordinated efforts involving US government agencies and private-sector organisations had already resulted in the freezing of more than $2.7 billion in stolen cryptocurrency.
Recovery operations remain underway as investigators attempt to trace additional assets being moved through cryptocurrency bridges, mixing services and digital asset exchanges.
Authorities said the hackers have been using these platforms to obscure the movement and ownership of stolen funds, complicating efforts to identify and recover the assets.
In a separate operation, US investigators also disrupted cloud infrastructure supporting FaceStealer, a North Korean social engineering operation allegedly responsible for more than $400 million in cryptocurrency theft over an 18-month period.
According to the Justice Department, the FaceStealer scheme relies on deceptive online interactions designed to persuade victims to install malicious software.
Hackers reportedly contact potential targets through compromised accounts and invite them to participate in video meetings.
During these meetings, the attackers play prerecorded footage of individuals known to the victims, creating the impression that they are communicating with trusted contacts.
The perpetrators then simulate technical difficulties and offer supposed solutions that require victims to install software.
The software contains malware that allows the attackers to steal cryptocurrency and potentially gain access to additional online accounts.
As part of the investigation, the Federal Bureau of Investigation (FBI) seized more than 900 webcam videos of victims associated with the operation.
US authorities also warned that the scheme has increasingly targeted developers working on open-source software projects.
Investigators said such targeting could enable software supply-chain attacks, in which compromised development tools or software components are used to reach a wider range of victims.
The Justice Department said efforts to recover stolen cryptocurrency and dismantle the infrastructure supporting North Korean cyber operations remain ongoing.
The latest enforcement actions highlight the scale of the alleged cryptocurrency thefts and the increasingly sophisticated methods used by cybercriminal groups to gain access to digital assets and conceal stolen funds.