Federal authorities have seized more than $1.2 billion worth of cryptocurrency plundered from Binance, striking a major financial blow against North Korean state hackers.
Last month's cyber attack on the world's largest exchange drained roughly $6.3 billion, cementing it as the largest cryptocurrency heist in global history. The FBI attributed the breach directly to TraderTraitor, an elite cyber warfare unit operating under Pyongyang's command. So far, coordinated operations between the United States government and private industry partners have frozen more than $2.7 billion of the stolen haul. The Department of Justice secured formal judicial warrants on Thursday authorizing federal agents to seize or restrain over $1.2 billion of those locked funds.
The cash clawback is unprecedented.
Under standard federal asset-recovery procedures, federal prosecutors will submit a civil forfeiture claim before a judge, who will evaluate ownership rights and supervise restitution for the recovered capital.
Pyongyang's state-directed cyber operations have evolved into an industrial pipeline designed to bypass international sanctions and bankroll military hardware. Federal officials have traced multiple breaches directly to state-backed hacking rings, with TraderTraitor orchestrating the Binance intrusion through compromised cryptographic keys and network vulnerabilities.
The recovered digital assets represent a fraction of the total haul, yet the seizure cuts off crucial liquidity for the regime.
| :--- | :--- | :--- | :--- | :--- | :--- |
|---|---|---|---|---|---|
| Combined Funds Frozen to Date | Exceeding $2.7 billion | ||||
| Value Authorized for Federal Seizure | Over $1.2 billion | ||||
| Primary Hacking Syndicate Identified | TraderTraitor (North Korea) | ||||
| Secondary Campaign Identified | FaceStealer ($400 million) |
Thursday's enforcement disclosure coincided with a separate federal alert implicating North Korean operatives in an 18-month social engineering campaign known as FaceStealer. That operation siphoned $400 million in digital assets through targeted infiltration of popular messaging platforms.
Pyongyang’s operatives deployed synthetic media to fool targets. The syndicate hijacked corporate accounts and recorded high-resolution deepfake video feeds to impersonate executives and technical personnel during verification calls. The ploy duped company employees into handing over cryptographic credentials and authorization tokens.
Yet the ultimate destination of the stolen capital remains consistent across both operations. American intelligence officials have documented that revenue siphoned through cyber intrusions directly underwrites North Korea's prohibited ballistic missile and nuclear weapons development.
Federal prosecutors will file formal civil forfeiture papers in the coming weeks, opening judicial proceedings to process restitution claims for the seized $1.2 billion while investigators track the remaining unrecovered Binance assets across international mixer services.