DOJ Secures Court Authorization For $1.2B Stolen From Binance

The U.S. Justice Department has disclosed the first court proceeding seeking to recover funds from what authorities describe as the largest cryptocurrency theft on record. The FBI attributes the theft to TraderTraitor, a North Korean hacking operation.

More than $6 billion in cryptocurrency was taken from Binance wallets across 10 blockchains, according to blockchain analysis. One analysis put the total at about $6.36 billion.

Government agencies and private companies have frozen more than $2.7 billion of the stolen assets, the Justice Department said. Efforts to trace, freeze, seize and forfeit the remaining funds are continuing while the hackers move cryptocurrency through blockchain bridges, mixers and exchanges.

The department did not identify the tokens or wallets covered by the authorization, or the court that issued it. Its wording refers to assets authorities may “seize or restrain,” rather than assets already seized. A restraint order can keep funds in place while forfeiture proceedings continue. The department did not disclose how much of the $1.2 billion had entered government custody.

Assistant Attorney General A. Tysen Duva said the Justice Department’s Criminal Division helped “immediately halt about half of this historic breach.” The National Security Division, the Criminal Division’s Computer Crime and Intellectual Property Section and the U.S. Attorney’s Office for the District of Columbia worked with cryptocurrency companies on the response.

Binance reported on Nov. 12 that it had replaced all affected customer assets with company funds. The exchange used money from its Secure Asset Fund for Users, part of its futures insurance fund and its corporate treasury. The total exceeded $6.34 billion.

The Justice Department has not said how any assets later forfeited in the case would be distributed. Under its remission rules, claimants generally must show a specific financial loss and must not have already been compensated. Binance could seek recovery for losses it covered, but the department has not announced how it will handle claims in this case.

Forfeiture proceedings can take time. If a court orders the assets forfeited, the Justice Department must review claims before distributing any funds. The department says it cannot provide a timetable for payments. A future forfeiture complaint would identify the wallets and tokens covered by the authorization.

Most of the frozen cryptocurrency consists of stablecoins, including USDT and USDC. Their issuers can block or reissue tokens after receiving valid legal process. Bitcoin and Ether linked to the theft are harder to immobilize and have continued moving through laundering routes, according to investigators.

The theft began on Oct. 29, when about $6.36 billion in cryptocurrency left affected wallets. The FBI later published hundreds of connected addresses for cryptocurrency platforms to block. Binance began restoring withdrawals in stages on Nov. 1 and reported that about 98% of affected assets had been replaced by Nov. 4.