DOJ Wins Court Authority to Seize $1.2 Billion of North Korea’s Stolen Binance Crypto as Freezes Top $2.7 Billion

Bitcoin Magazine

DOJ Wins Court Authority to Seize $1.2 Billion of North Korea’s Stolen Binance Crypto as Freezes Top $2.7 Billion

The DOJ said Thursday it has court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, part of a freeze of more than $2.7 billion that officials said halted about half of North Korea’s October exchange heist.

In a Thursday announcement, the department said that on or about Oct. 29, members of the North Korean military, referred to by the FBI as TraderTraitor, stole more than $6 billion worth of virtual assets from Binance. That is below the $6.34 billion figure Binance has covered since the attack.

Binance said it had completed coverage of the assets hit in the breach, replacing the tokens from company funds rather than by recovering the stolen coins. Those are separate tracks: the DOJ is trying to interdict what was taken, while the exchange has said users were made whole from its Secure Asset Fund for Users, a portion of its futures insurance fund and its treasury.

Assistant Attorney General A. Tysen Duva of the DOJ’s Criminal Division said the department and its partners were able to “immediately halt about half of this historic breach” by freezing stolen assets “before they got beyond law enforcement reach.” The freeze of more than $2.7 billion is a joint figure for U.S. government and private-sector efforts. Of that amount, the DOJ said it has already obtained court authorization to seize or restrain more than $1.2 billion. The underlying court papers were not posted with the announcement.

The $1.2 billion is not newly recovered money but comes out of the roughly $2.85 billion Binance said on Nov. 3 had been frozen or intercepted, and Thursday’s court authorization is the legal step that lets the government move toward taking ownership of those funds through forfeiture, where until now they had simply been frozen at the token issuers.

Even that freeze is not the end of the trail. The DOJ said TraderTraitor actors are still moving the stolen assets through cryptocurrency bridges, mixers and exchanges, and that tracing, seizure and forfeiture work continues. Last week, on Oct. 31, the FBI, with the U.S. Secret Service and IRS Criminal Investigation, issued a Cyber Alert attributing the theft to North Korea and urging virtual asset service providers to block transactions with or derived from addresses the actors are using. The alert said investigators have seen the stolen assets converted primarily into ether.