US wins authority over $1.2bn in crypto stolen from Binance

US authorities have court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, while efforts to trace and freeze the remaining funds continue. The Justice Department announced the action on Thursday, Nov. 12, as part of a broader effort to disrupt North Korean cryptocurrency theft.

How much was stolen, and how much is now held?

The Justice Department says members of the North Korean military, whom the FBI calls TraderTraitor, stole more than $6 billion in virtual assets from Binance on or about Oct. 29. The Associated Press reported the theft at about $6.3 billion and said the FBI had attributed it to a North Korean hacking group.

Since the theft, US agencies and private-sector partners have worked with virtual asset service providers, or VASPs, to stop the assets from moving. The Justice Department says those efforts have frozen more than $2.7 billion. A court has authorized the government to seize or restrain more than $1.2 billion of that frozen total, according to the department’s announcement.

That distinction matters: court authorization to seize or restrain funds does not mean the government has already recovered the full amount or returned it to Binance. The AP reported that the government typically files a forfeiture claim with a judge, who then decides who has a legitimate claim to recovered funds.

How are investigators trying to stop the crypto?

Investigators trace the stolen assets as they move between cryptocurrency addresses and services. The Justice Department says the attackers have continued laundering funds through crypto bridges, mixers and exchanges. Those tools can move assets between networks, pool transactions or route funds through trading platforms, creating more steps for investigators to follow.

Authorities can ask VASPs to block transactions involving identified addresses. The FBI, working with the US Secret Service and IRS Criminal Investigation, issued a cyber alert last week urging providers to block transactions with, or derived from, addresses TraderTraitor actors are using to launder the Binance funds. The FBI’s alert, as described by the Justice Department, gives providers a way to flag transfers linked to the theft before they move further.

What happens to the remaining funds?

The Justice Department says efforts to trace, freeze, seize and forfeit the stolen assets are ongoing. More than $2.7 billion has been frozen through combined government and industry work; the department has court authority covering more than $1.2 billion of that amount. The figures describe different stages of the response, rather than separate pools of recovered money.

The immediate effect is that providers have been asked to help prevent further transfers, while US agencies pursue legal control of part of the frozen assets. The department has not said in its announcement that the entire $1.2 billion has been forfeited or returned. The final disposition will depend on the ongoing recovery and forfeiture process.

Sources and documents

• announcement — justice.gov