FBI Claws Back $1.2 Billion From North Korea's Record Binance Crypto Heist
The FBI says the U.S. has seized or restrained more than $1.2 billion in cryptocurrency stolen from Binance, clawing back a chunk of the roughly $6.3 billion taken in what has been called the biggest crypto heist in history. The FBI has blamed the theft on North Korean hackers.
The announcement came Thursday, Nov. 12, about two weeks after the Oct. 29 hack on Binance, the world's largest cryptocurrency exchange, according to CBS News.
How the Government Got the Money Back
Since the hack, U.S. authorities and private sector partners have frozen more than $2.7 billion of the stolen funds. The Justice Department said it "obtained court authorization" to seize or restrain more than $1.2 billion of that amount, according to Cointelegraph.
Investigators are still working to recover more of the stolen crypto.
Seizing the money is only the first step. Funds like these typically go through a forfeiture process, and a judge ultimately decides who has a legitimate claim to them, The Associated Press reported.
"Cryptocurrency unfortunately has become fertile ground for North Korea to defraud victims and fund its malign activities," said First Assistant U.S. Attorney Bill Essayli.
U.S. Attorney Jeanine Pirro said the government has "consistently met them head on."
FBI Pins Record Heist on North Korea
The FBI has attributed the Binance theft to TraderTraitor, a North Korean hacking group. The bureau also blamed the same group for the $1.5 billion theft from the crypto exchange Bybit in February 2025.
Binance co-CEO Richard Teng described the breach as a "complex attack" that involved a compromised laptop and malicious software designed to delete evidence of the activity, according to Al Jazeera.
The FBI said the stolen assets were being laundered mainly into Ethereum. It urged crypto businesses to block transactions tied to the theft and published suspect wallet addresses.
Kim Yo Jong, sister of North Korean leader Kim Jong Un, has denied that North Korea was involved.
U.S. officials say North Korea uses cyber schemes like these to help fund its regime and its weapons program.
What It Means for Binance Customers
Binance has said that it, not its users, will absorb the losses. The exchange said it covered the affected assets with its own funds, drawing on its $1 billion user protection fund, a futures insurance fund and its corporate treasury.
Binance said it had replaced about 90% of the stolen amount by buying new tokens, and that the remaining, less liquid 10% would take longer to cover.
Binance temporarily halted withdrawals after the hack, then began reopening them. The exchange later posted a proof-of-reserves snapshot on X showing "at least one-to-one backing" for customer assets.
It is not yet clear what will happen to the seized funds or whether any of them will end up back with Binance.
Feds Also Shut Down Deepfake Crypto Scheme
Alongside the Binance announcement, the FBI also blamed North Korea for a separate scheme dubbed "FaceStealer," which the Justice Department says stole more than $400 million in crypto over 18 months.
The hackers hijacked messaging apps and used AI-generated deepfake videos of well-known crypto figures on video calls to build trust with their targets. They then used fake technical fixes to trick people into installing malware.
The targets were mainly people who work in crypto and Web3, and the hackers increasingly went after open-source software developers to get into their devices and code.
U.S. authorities seized cloud infrastructure used in the campaign. The FBI also seized more than 900 webcam videos of victims under a federal warrant and published an advisory with tips on how to stay protected.
For everyday investors, the case is another reminder to know the crypto scam signs before sending money to anyone online.
Curious for more stories that keep you informed and entertained? From the latest headlines to everyday insights, YourLifeBuzz has more to explore. Dive into what’s next.