Secure

insurance

SAFU

<ul>
 <li><strong>U.S. court orders cover part of the cryptocurrency already immobilized through coordinated industry intervention.</strong></li>
 <li><strong>Binance says it has fully covered affected customer assets, shifting attention toward the recovery of its own financial losses.</strong></li>
 <li><strong>The FBI’s FaceStealer investigation exposes how stolen video recordings can support long-running social-engineering attacks.</strong></li>
</ul>
<p>The U.S. Justice Department announced court-authorized action involving more than $1.2 billion in cryptocurrency stolen during North Korea’s October attack on Binance, marking a major enforcement development in the largest known cryptocurrency theft.</p>
<p><strong><a href="https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency" rel="noopener noreferrer nofollow">In its November 12 announcement</a></strong>, the department said coordinated efforts had frozen more than $2.7 billion and that the assets covered by its seizure or restraint orders formed part of that amount.</p>
<p>The action follows an attack estimated at <strong><a href="https://ethnews.com/binances-6-3b-hack-exposes-a-new-hot-wallet-security-risk/" rel="noopener noreferrer nofollow">approximately $6.3 billion</a></strong>, which the FBI attributed to North Korea’s TraderTraitor operation. Authorities also disclosed the disruption of FaceStealer, a separate campaign using manipulated identities and recorded video calls to compromise victims.</p>
<p>For Binance customers, the financial situation has already changed. The exchange reported on November 12 that it had completed coverage of affected customer assets using its own resources and protection funds. That replacement process is distinct from the government’s efforts to recover the original stolen cryptocurrency.</p>
<h2 id="what-the-doj-actually-secured">What the DOJ Actually Secured</h2>
<p>The Justice Department’s figures describe two stages of intervention.</p>
<p>Stablecoin issuers, exchanges and blockchain investigators initially worked to prevent stolen assets from moving through cryptocurrency networks. Federal authorities subsequently obtained court authorization to seize or restrain a portion of the identified funds.</p>
<p>The government action therefore cannot be added to the industry-wide freeze total as a separate recovery.</p>
<div style="max-width: 700px; margin: 24px auto; font-family: Arial,Helvetica,sans-serif; color: #243449;">
 <div style="border-left: 4px solid #315f78; padding-left: 12px; margin-bottom: 14px;">
  <div style="font-size: 17px; font-weight: bold; line-height: 1.35;">
   What Happens to Recovered Crypto?
  </div>
  <div style="font-size: 12px; color: #69798a; margin-top: 4px;">
   Three stages of asset recovery under U.S. enforcement
  </div>
 </div>
 <div style="display: flex; flex-wrap: wrap; gap: 10px;">
  <div style="flex: 1 1 185px; border: 1px solid #dce5eb; border-radius: 9px; padding: 15px; background: #f6f9fb;">
   <div style="font-size: 11px; font-weight: bold; letter-spacing: 1px; color: #547184;">
    01 / FROZEN
   </div>
   <div style="font-size: 15px; font-weight: bold; margin: 9px 0;">
    Transfers blocked
   </div>
   <div style="font-size: 12px; line-height: 1.6;">
    An issuer or platform prevents identified assets from moving.
   </div>
   <div style="border-top: 1px solid #dce5eb; margin-top: 12px; padding-top: 10px; font-size: 12px;"><strong>Victim access:</strong> No automatic claim
   </div>
  </div>
  <div style="flex: 1 1 185px; border: 1px solid #dce5eb; border-radius: 9px; padding: 15px; background: #f6f9fb;">
   <div style="font-size: 11px; font-weight: bold; letter-spacing: 1px; color: #547184;">
    02 / SEIZED
   </div>
   <div style="font-size: 15px; font-weight: bold; margin: 9px 0;">
    Legal control
   </div>
   <div style="font-size: 12px; line-height: 1.6;">
    Authorities obtain control or court-authorized restraint over identified property.
   </div>
   <div style="border-top: 1px solid #dce5eb; margin-top: 12px; padding-top: 10px; font-size: 12px;"><strong>Victim access:</strong> Further proceedings required
   </div>
  </div>
  <div style="flex: 1 1 185px; border: 1px solid #dce5eb; border-radius: 9px; padding: 15px; background: #f6f9fb;">
   <div style="font-size: 11px; font-weight: bold; letter-spacing: 1px; color: #547184;">
    03 / FORFEITED
   </div>
   <div style="font-size: 15px; font-weight: bold; margin: 9px 0;">
    Distribution possible
   </div>
   <div style="font-size: 12px; line-height: 1.6;">
    A completed forfeiture can make assets available for eligible compensation processes.
   </div>
   <div style="border-top: 1px solid #dce5eb; margin-top: 12px; padding-top: 10px; font-size: 12px;"><strong>Victim access:</strong> Subject to eligibility
   </div>
  </div>
 </div>
 <div style="font-size: 11px; line-height: 1.5; color: #718096; margin-top: 11px;">
  Source: U.S. Department of Justice asset forfeiture and victim compensation guidance.<span style="color: #222222; font-family: Verdana, BlinkMacSystemFont, -apple-system, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, 'Open Sans', 'Helvetica Neue', sans-serif; font-size: 15px;">&nbsp;</span>
 </div>
</div>
<p>Chainalysis previously documented how quickly the attackers attempted to escape issuer-controlled stablecoins. <strong><a href="https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/" rel="noopener noreferrer nofollow">Its investigation</a></strong> of the Binance exploit identified a sequence in which $325 million in stablecoins was exchanged for approximately $285 million in ETH over nearly 20 minutes.</p>
<p>The attackers sacrificed value to acquire an asset that could not be frozen directly by a stablecoin issuer.</p>
<p>Investigators also identified automated laundering patterns, including repeated transactions through newly funded wallets. Some addresses initially received exactly 1 TRX before processing additional transfers, suggesting a scripted approach to distributing the proceeds.</p>
<p>The FBI’s October 31 TraderTraitor alert published Ethereum addresses associated with the operation, including:</p>
<ul>
 <li><strong>0x8532FA14ACAf483729C449b8458aedDb900543D4</strong></li>
</ul>
<p>For compliance teams, those identifiers provide a starting point for transaction screening. Investigators must still assess transaction histories and counterparties to distinguish direct exposure from incidental transfers.</p>
<h2 id="why-binance-is-central-to-the-compensation-question">Why Binance Is Central to the Compensation Question</h2>
<p>Binance’s response changes who may ultimately have a financial claim against recovered assets.</p>
<p>The exchange initially used corporate reserves, its Secure Asset Fund for Users (SAFU) and a portion of its futures insurance reserves to replace stolen holdings.</p>
<p>Its November 4 recovery update reported that approximately 98% of affected assets had been replenished, with the remaining purchases involving less-liquid tokens.</p>
<p>The company subsequently said that coverage was complete, although its latest proof-of-reserves verification remained pending.</p>
<p>Customers whose balances have been restored generally would not have an outstanding loss equal to the amount already reimbursed. Binance or other parties that actually absorbed the financial damage may therefore have a stronger economic interest in any subsequent recovery.</p>
<p>That does not automatically establish their legal entitlement to forfeited assets. The applicable ownership records, court orders and compensation rules will determine who qualifies.</p>
<p>The DOJ’s victim-compensation guidance explains that remission petitions typically require proof of a direct financial loss, supporting records and disclosure of compensation already received.</p>
<p>An authorized seizure is only one step. A forfeiture proceeding and any applicable victim-compensation process must address the ultimate disposition of the property.</p>
<h2 id="facestealer-turned-familiar-faces-into-attack-tools">FaceStealer Turned Familiar Faces Into Attack Tools</h2>
<p>The Justice Department also announced the disruption of FaceStealer, a North Korean operation that allegedly stole more than $400 million in cryptocurrency over an 18-month period.</p>
<p>According to the government’s account, investigators seized more than 900 recorded victim videos associated with the scheme.</p>
<p>Attackers used deepfake technology and previously captured recordings to impersonate people their targets already trusted during live calls.</p>
<p>Some compromises were exploited only after lengthy delays, including cases in which operators waited more than a year before stealing assets.</p>
<p>That approach undermines a common assumption in corporate security: that seeing and hearing a familiar colleague is sufficient evidence of identity.</p>
<p>A recording obtained during an ordinary business meeting can become material for a later impersonation attempt. An attacker may use it to support a request for software installation, privileged access or transaction approval long after the original interaction.</p>
<p>The delay also complicates incident investigations because the initial social-engineering event may appear unrelated to the eventual theft.</p>
<h2 id="how-crypto-firms-can-defend-against-deepfake-approvals">How Crypto Firms Can Defend Against Deepfake Approvals</h2>
<p>The operational response should focus on authorization controls that remain effective when an attacker can reproduce a person’s appearance and voice.</p>
<p>Treasury teams handling high-value transfers should require hardware-backed authentication, independently verified transaction details and multisignature approvals where appropriate.</p>
<p>FIDO2 or WebAuthn security keys can help protect account authentication, while hardware-wallet or institutional signing systems can verify transaction-specific approvals. These are separate controls and should be deployed together where the risk warrants it.</p>
<p>A video call may still be useful for communication, but it should never be the sole basis for authorizing a sensitive transfer.</p>
<p>Security teams should also review dormant privileged access and unusual software deployments. FaceStealer’s reported delays show why monitoring only the hours immediately following a suspicious interaction can miss an attacker’s eventual objective.</p>
<h2 id="what-happens-to-the-seized-cryptocurrency-next">What Happens to the Seized Cryptocurrency Next?</h2>
<p>Court-authorized restraint can prevent assets from being moved while investigators pursue forfeiture or related legal proceedings.</p>
<p>The next steps may include civil forfeiture filings, challenges from parties claiming an interest in the assets and decisions about their eventual distribution.</p>
<p>For Binance, the outcome could determine how much of the financial burden absorbed through corporate and protection reserves is ultimately recovered.</p>
<p>The exchange has separately committed to restoring SAFU to approximately $1 billion. Its final funding position and any recovery through U.S. legal proceedings remain distinct accounting questions.</p>
<p>Anyone approached by an alleged recovery agent should verify the communication through the Justice Department or FBI Internet Crime Complaint Center. Government victim-compensation petitions do not require advance recovery fees.</p>
<p>The post <a href="https://ethnews.com/doj-seizes-1-2b-in-binance-hack-funds-tied-to-north-korea/" rel="noopener noreferrer nofollow">DOJ Seizes $1.2B in Binance Hack Funds Tied to North Korea</a> appeared first on <a href="https://ethnews.com" rel="noopener noreferrer nofollow">ETHNews</a>.</p>

DOJ Seizes $1.2B in Binance Hack Funds Tied to North Korea

Table of Contents

ETHNews

Other articles published on Nov 12, 2026

Join our free newsletter for daily crypto updates!