US Details $2.7 Billion Freeze After North Korea’s Binance Hack

The Justice Department says it’s joined with the two biggest stablecoin issuers in efforts to secure almost half the money stolen when hackers absconded with more than $6 billion from the Binance crypto exchange.

The department got court authorization to seize or restrain $1.2 billion of the $2.7 billion of funds frozen by Tether and Circle Internet Group Inc. in the immediate aftermath of the Oct. 29 break-in. Investigators are continuing to pursue the rest as the hackers, whom the FBI calls TraderTraitor, try to launder the cryptocurrency through bridges, mixers and exchanges. 

“The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains,” M. Scott Proctor, principal deputy assistant attorney general for national security, said in a statement. He said North Korea uses cryptocurrency theft to finance its government and weapons program. 

The attack on the world’s largest crypto exchange was the biggest cryptocurrency theft on record, siphoning $6.3 billion in digital assets from customers. Binance has since replaced all of the stolen assets using profits and emergency funds. 

The exchange has said the hackers initially compromised an engineer through a fake job interview before infiltrating other employees who worked on its digital wallets, part of what Binance described as a months-long operation involving malicious software, compromised devices and artificial intelligence.

The hackers then began moving the stolen assets through thousands of digital wallets and multiple blockchains to obscure their origins. Within a week, the laundering operation had used more than 20,000 wallets and executed at least 65,000 transactions, according to blockchain analytics firm Elliptic, while stablecoin issuers and other companies moved to freeze billions of dollars before they could be transferred.

Assistant Attorney General A. Tysen Duva said the Criminal Division and law enforcement partners froze Binance assets “before they got beyond law enforcement reach,” halting about half of what he called a “historic breach.”

The FBI, Secret Service and Internal Revenue Service issued an alert shortly afterward attributing the theft to North Korea and urging the digital-asset companies to block transactions involving addresses used by the hackers. North Korea has denied responsibility for cryptocurrency thefts attributed to it.

The Justice Department also said Thursday that it seized cloud infrastructure supporting a separate North Korean hacking operation that has stolen more than $400 million in cryptocurrency over the past 18 months. The FBI calls the scheme FaceStealer.

FaceStealer uses victims themselves to make the next attack more convincing. Hackers hijack messaging and social-media accounts and use them to invite the victim’s contacts to fake Zoom or Microsoft Teams meetings. Once a target joins, they play prerecorded webcam footage of someone the target knows, manufacture an apparent technical problem and offer a “fix” that instead installs malware.

“If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” Patrick Grandy, assistant director in charge of the FBI’s Los Angeles field office, said in a statement.

The FBI seized more than 900 webcam videos secretly recorded from victims and later used to impersonate them. The hackers have also begun using deepfakes of prominent figures in the cryptocurrency industry to make fraudulent meetings more convincing.

The campaign is increasingly targeting open-source software developers, raising the prospect that compromising a single person could expose far larger numbers of users. Earlier this year, hackers infected the computer of a maintainer of a JavaScript library downloaded tens of millions of times a week and attempted to create malicious dependencies that would have been distributed with legitimate downloads. The effort was detected before the malicious software could spread, according to the FBI.

©2026 Bloomberg L.P.

This article was generated from an automated news agency feed without modifications to text.