DOJ Court Order to Seize $1.2B from Binance Hacker - On-Chain Data

Click here for Arkham’s Binance Hacker entity profile.

The U.S. Department of Justice has court approval to seize or restrain more than $1.2 billion of the crypto stolen in last month’s over $6 billion Binance hack.

In a November 12 announcement, the DOJ said U.S. government and private sector efforts have now frozen more than $2.7 billion of the stolen funds. Court orders cover over $1.2 billion of that total.

This is the first step towards returning the funds to Binance. Frozen assets must be seized and forfeited before they can be restored to victims.

FBI Names TraderTraitor

The DOJ names TraderTraitor as the perpetrator of the October 29 hack. The FBI describes TraderTraitor as members of the North Korean military (read our guide to Lazarus Group here). 

On October 31, the FBI, Secret Service and IRS-CI (branch of Internal Revenue Service responsible for criminal investigations) issued a Cyber Alert. It urged crypto service providers to block transactions tied to addresses the group is using to launder the stolen assets. (Find out how to do this using Arkham.)

Laundering through bridges, mixers and exchanges is still going on, and work to trace, freeze, seize and forfeit the funds continues. The FBI’s Los Angeles Field Office, Cyber Division and Virtual Asset Unit are leading recovery.

The screenshot below shows the Binance Hacker using THORChain to swap ETH as recently as yesterday (12th November). 

$2.4B Still Liquid

Arkham data shows the attacker still controls roughly $2.7 billion in liquid (unfrozen) funds. That includes 18K BTC ($1.28B), and 602K ETH ($1.19B).

Stablecoin issuers were among the first to act after the hack. Tether blacklisted the attacker’s USDT within an hour of the drain, and Circle froze USDC minutes later. Arkham separates frozen and liquid assets. 

FaceStealer Campaign

The DOJ also described FaceStealer, a separate North Korean campaign. It has stolen over $400 million in 18 months by using fake video meetings and AI deepfakes to install malware on crypto workers’ devices.

This is a developing story.