U.S. authorities and private-sector partners have frozen more than $2.7 billion in cryptocurrency stolen in a major cyberattack on Binance, the Justice Department said. Binance says it has fully covered the assets affected by the breach, which took place last month.
More than $6 billion in digital assets were stolen from the exchange in an Oct. 29 attack attributed to North Korean hackers. Investigators have also received court approval to seize or restrict access to more than $1.2 billion as they work to trace and recover the remaining funds.
Binance said it had completed covering the assets affected by the incident, whose estimated impact was about $6.3 billion. The company also released an updated snapshot of its Proof of Reserves.
Federal investigators attributed the theft to North Korean military hackers operating under the name TraderTraitor. Authorities said the group has tried to move the stolen cryptocurrency through exchanges, cross-chain bridges and mixing services that can make transactions harder to track.
U.S. Attorney Jeanine Ferris Pirro said investigators and private-sector partners moved quickly to freeze the funds. She noted that a court had authorized the seizure or restriction of more than $1.2 billion in assets.
Binance co-CEO Richard Teng has said the company shut down the access points exploited in the attack and rebuilt affected systems. According to the exchange, the breach began with a fake job interview that compromised an employee’s computer. Hackers then used access to internal systems to carry out unauthorized transactions.
The Justice Department also said it had disrupted a separate North Korean hacking operation, known as FaceStealer, which investigators linked to more than $400 million in cryptocurrency thefts over the past 18 months.
The operation used deceptive video calls, secretly captured webcam footage and AI-generated deepfakes to persuade victims to install malicious software, the department said. The FBI said hackers posed as trusted contacts in video meetings, then presented fake technical issues and urged victims to click harmful links.
Investigators seized more than 900 webcam videos of victims. The FBI warned that the scheme has increasingly targeted not only cryptocurrency investors and industry workers, but also developers who maintain open-source software, potentially putting wider technology systems at risk.
