WASHINGTON — Federal law enforcement struck back against the largest cryptocurrency heist in history, securing court authority to seize more than $1.2 billion in digital assets stolen from Binance.
Last month, hackers systematically emptied $6.3 billion from the world's largest exchange in a blitz that lasted barely 20 minutes. The Federal Bureau of Investigation attributed the October 29 raid to TraderTraitor, a North Korean state-backed cyber group that loots commercial crypto networks to finance Pyongyang's nuclear and ballistic missile programs. Joint operations between federal agents and private blockchain security teams have now frozen more than $2.7 billion of the stolen haul, with the Department of Justice taking custody of the latest $1.2 billion tranche.
Criminal networks cannot easily conceal billions on public ledgers.
Binance internal investigators initially suspected an employee laptop had been compromised. But forensic analysis quickly revealed a far deeper intrusion. Attackers had bypassed wallet private keys entirely, infiltrating the exchange's transaction-signing infrastructure—the administrative nerve center that clears and executes asset transfers.
"The attackers compromised the transaction-signing infrastructure, which authorises transfers and allows funds to be moved out of wallets," confirmed blockchain intelligence firm TRM Labs. The breach handed North Korean operatives total clearance to siphon liquid reserves directly from transaction-processing hot wallets.
Co-chief executive Richard Teng moved swiftly to calm market panic. Teng announced that Binance will fully absorb the losses, reimbursing impacted account holders through the company's emergency reserve pool—the Secure Asset Fund for Users (SAFU)—alongside company capital reserves.
Losses will be covered through the company's Secure Asset Fund for Users and its own resources.
Richard Teng, Co — CEO, Binance
The thieves scrambled to shield their loot from immediate freezes. Because stablecoins like Tether’s USDT and Circle’s USDC contain centralized smart-contract blacklisting functions, issuers can freeze balances on command. To counter this, TraderTraitor attempted to swap hundreds of millions in stablecoins for native Ethereum.
Blockchain analytics firm Chainalysis tracked the hackers converting $325 million in stablecoins into approximately $285 million worth of Ethereum inside a 20-minute window. Yet federal authorities and crypto firms intercepted the flow faster than anticipated. The first wallet freeze locked down stolen funds at 5:14 p.m. Eastern Time on October 29—hours after the initial alarm tripped.
Forensic teams also discovered that the Binance loot was run through digital mixing services alongside assets stolen during an earlier assault on exchange Bitget, cementing the digital fingerprint back to North Korea's cyber command.
| Asset & Breach Metrics | Official Case Details |
|---|---|
| Total Stolen from Binance | Approximately $6.3 billion |
| Total Funds Frozen to Date | Exceeds $2.7 billion |
| Latest Court-Ordered Seizure | More than $1.2 billion |
| Primary Breach Target | Transaction-signing infrastructure |
| Attributed Cyber Syndicate | TraderTraitor (North Korea) |
| Attack Duration | Approximately 20 minutes on October 29 |
Federal prosecutors will now initiate formal civil forfeiture proceedings in US District Court, filing claims before a federal judge to adjudicate legal ownership and establish clear restitution pathways for the recovered $1.2 billion.