The FBI announced Thursday that US authorities have seized or obtained court authorization to seize more than $1.2 billion in cryptocurrency taken last month from Binance, the world’s largest digital asset exchange. The October 29 incident involved roughly $6.3 billion and ranks as the largest cryptocurrency theft on record.

Officials attribute the Binance breach to TraderTraitor, a North Korean hacking group. The Justice Department said the latest court orders cover more than $1.2 billion of the total frozen so far. Combined efforts by the US government and private-sector firms have already immobilized more than $2.7 billion of the stolen assets.

Details of the October Breach

Hackers drained approximately $6.3 billion from Binance wallets used to process transactions. Blockchain records show the bulk of the transfers occurred within about 20 minutes. The exact method of the intrusion remains under investigation. Binance initially pointed to a compromised laptop before identifying additional points of entry.

Cybersecurity analysts determined that the attackers gained control of the exchange’s transaction-signing infrastructure, the system that authorizes fund movements. This allowed the transfer of assets without necessarily obtaining the underlying wallet keys.

After the initial drainage, the perpetrators moved funds across multiple wallets and blockchains in an attempt to evade tracking. A substantial share of the stolen value was held in stablecoins such as Tether’s USDT and Circle’s USDC. These tokens can be frozen by their issuers when investigators flag suspicious activity, unlike fully decentralized assets such as Bitcoin or Ethereum.

One analytics firm tracked the conversion of $325 million in stablecoins into roughly $285 million worth of Ethereum during a 20-minute window as the attackers sought to place the assets beyond the reach of issuers. Freezing actions began within hours of the theft, with the first measures recorded around 5:14 p.m. Eastern Time on October 29.

Recovery Process and Forfeiture

In cases of this type, the government typically initiates civil forfeiture proceedings. A judge then decides who holds a legitimate claim to the recovered funds. The $1.2 billion now subject to court authorization forms part of the larger pool already frozen by authorities and industry partners.

Binance has stated that its internal investigation continues. The exchange’s co-CEO indicated that customer losses would be covered through the company’s Secure Asset Fund for Users and its own resources.

Additional North Korean Activity

On the same day, the FBI linked North Korea to a separate social-engineering operation known as FaceStealer. Officials said the scheme resulted in the theft of $400 million in cryptocurrency over the past 18 months. The operation combined the hijacking of popular messaging applications with the creation of deepfake videos.

US authorities have long accused North Korea of conducting cyber operations to generate revenue for its government and prohibited weapons programs, including nuclear and ballistic-missile activities. Investigators noted that some funds from the Binance theft were mixed with assets taken in an earlier attack on the Bitget exchange, which had also been attributed to North Korean actors.

The actions form part of ongoing efforts to disrupt these revenue streams and enforce international sanctions against the regime.