The Library Media — Business & Markets · Markets Desk
FBI Seizes More Than $1.2 Billion in Crypto Linked to Historic Binance Heist
By Zavier Wong
Photo: voytek pavlik / Wikimedia Commons (Public domain)
The FBI said Thursday it had seized more than $1.2 billion in cryptocurrency reported stolen last month from Binance, the world’s largest cryptocurrency exchange, marking a significant step in the U.S. government’s efforts to recover funds from what investigators have described as the biggest cryptocurrency heist in history.
The theft involved approximately $6.3 billion in cryptocurrency, according to the Associated Press. The FBI has previously attributed the attack to a North Korean hacking group known as TraderTraitor.
The latest seizure authorization represents a substantial portion of the funds that authorities and private-sector organizations have managed to freeze since the theft. According to the Associated Press, the U.S. government and private sector have together frozen more than $2.7 billion of the stolen cryptocurrency.
The Justice Department said Thursday that it had obtained court authorization to seize or restrain more than $1.2 billion of that amount.
The figures illustrate the scale of the recovery effort. Approximately $6.3 billion was stolen, more than $2.7 billion has been frozen, and more than $1.2 billion is now covered by the latest court-authorized seizure or restraint action.
However, freezing cryptocurrency and legally recovering ownership of it are not the same thing.
What happens to the seized cryptocurrency?
The Associated Press reported that the U.S. government typically pursues a formal forfeiture process in cases involving recovered assets.
Under that process, prosecutors generally file a claim of forfeiture with a judge. The judge then determines who has a legitimate claim to the recovered funds.
The court process is an important distinction for anyone following the recovery effort. A government seizure authorization does not, by itself, establish that the cryptocurrency has already been returned to its original owners.
Instead, the legal process provides a mechanism for determining the rightful ownership of assets that authorities have identified and restrained.
For victims of large cryptocurrency thefts, recovery can therefore involve more than identifying stolen funds or preventing them from moving. Authorities must also establish the legal basis for taking control of the assets and determine who is entitled to receive them.
The Justice Department’s announcement, as reported by the Associated Press, marks progress in that process, although the ultimate distribution of the recovered cryptocurrency remains subject to the relevant legal proceedings.
FBI identifies a separate North Korean crypto operation
The Binance case was not the only cryptocurrency-related cyber activity highlighted by U.S. authorities on Thursday.
The FBI also blamed North Korea for a separate social-engineering operation known as FaceStealer. Officials said the scheme resulted in the theft of approximately $400 million worth of cryptocurrency over the past 18 months.
According to the Associated Press, FaceStealer involves hijacking popular messaging applications and recording deepfake videos.
Social engineering relies on manipulating people or exploiting their trust rather than depending exclusively on technical weaknesses in computer systems. In this case, the FBI’s description points to the use of compromised messaging platforms and fabricated video material as part of the operation.
The allegations add another dimension to concerns about North Korean-linked cryptocurrency theft. The TraderTraitor attribution in the Binance case and the FBI’s separate allegations concerning FaceStealer describe different operations, but both highlight the risks posed by cyber activity attributed to the same country.
U.S. officials have repeatedly accused North Korea of using cyber schemes to generate money for its regime, including to support its illicit weapons programme, the Associated Press reported.
A warning for exchanges and their customers
The scale of the Binance theft and the separate FaceStealer allegations underline a difficult reality for the cryptocurrency industry: security threats can extend beyond individual users and isolated accounts to operations capable of targeting substantial amounts of digital assets.
For exchanges, the recovery effort demonstrates the importance of cooperation with law enforcement and private-sector partners in identifying and freezing stolen funds and preventing them from disappearing before authorities can act.
For customers, the cases are a reminder that holding or using cryptocurrency involves risks that go beyond price movements. A theft can affect assets held on an exchange even when a customer did not take an action that led to the theft.
The more than $1.2 billion seizure authorization is a major development, but it should not be confused with a completed recovery. It gives the government authority to pursue the funds that have already been frozen.
The remaining gap between the amount stolen, the amount frozen and the amount now subject to court-authorized seizure also shows that a significant amount of the stolen cryptocurrency remains unaccounted for.
The case also reinforces why cryptocurrency security must be treated as an essential part of the industry’s infrastructure. When a large exchange is targeted, the consequences extend beyond a single company to its customers, the wider market and the authorities responsible for recovering stolen assets.
Zavier Wong
Markets Desk, The Library Media
From The Library — the estate of our family.
