The U.S. Department of Justice has obtained court authority to seize more than $1.2 billion in cryptocurrency traced to October’s Binance hack – a major escalation in the response to the heist that the FBI attributes to North Korea’s TraderTraitor group. The seizure warrant lands as investigators report more than $2.7 billion of the stolen funds frozen overall, and as agents also took down cloud infrastructure tied to a separate “FaceStealer” campaign.
The October 29 breach of Binance, which saw more than $6 billion in total value leave the exchange’s control, remains the largest crypto theft on record. The seizure order converts what began as a damage-control scramble into a full-blown asset recovery case with federal teeth.
From the $6.3 billion heist to a $1.2 billion seizure
The DOJ’s authority covers a specific tranche of the proceeds – the portion investigators could confidently trace through mixing chains, cross-chain bridges and OTC desks. Securing a seizure order at this scale is a statement of forensic confidence: prosecutors do not ask courts to hand them assets they cannot prove are dirty.
Combined with earlier freezes, more than $2.7 billion of the haul is now immobilized – roughly 40% of the $6.34 billion taken in the attack. That recovery ratio would have been the stuff of fantasy even two years ago, and it reflects better cooperation between exchanges and stablecoin issuers than the industry managed in prior cycles.
North Korea’s laundering playbook
The FBI’s TraderTraitor attribution points at the same Pyongyang-linked apparatus behind the Lazarus playbook: immediate fragmentation of funds, rapid bridging to chains with thinner surveillance, and conversion into liquid assets through informal value transfer networks. Investigators say the actors went a step further this time – minting memecoins to help move the proceeds, turning the market’s favorite degenerate instrument into a laundering rail.
The FaceStealer seizure adds a second front. Agents seized infrastructure behind a campaign that stole more than $400 million over 18 months, underscoring that the by-product of the hack investigation is a broader map of North Korea’s on-chain revenue machine.
What happens next for the recovered funds
The seized crypto now enters the federal forfeiture pipeline, where eventual remission to victims follows established – if slow – procedures. Binance has said it will make affected users whole, but the government’s parallel recovery track gives the estate additional leverage against mixers and off-ramps still holding traceable balances.
For exchanges, the lesson is brutal but clarifying: post-breach, the race is no longer just about patching the hole. It is about who can trace, freeze and seize faster than the money moves. On this evidence, the defenders are finally keeping pace.
