North Korea Stole $6 Billion in Crypto. The DOJ Just Got the Right to Seize $1.2 Billion of It.

A Six Billion Dollar Withdrawal

North Korea didn't rob a bank. It robbed an exchange.

On or around Oct. 29, operatives the FBI tracks as TraderTraitor, working out of the North Korean military, pulled more than $6 billion in virtual assets off Binance. Six billion dollars. Moved out through wallets in less time than it takes most people to clear a wire transfer.

On Thursday the Justice Department said it now has court authority to seize or restrain more than $1.2 billion of that haul. That's one piece of a broader freeze topping $2.7 billion, counted across U.S. government and private-sector efforts together.

Assistant Attorney General A. Tysen Duva framed it as a footrace. His department and its partners, he said, stopped roughly half of the breach before the stolen assets got past law enforcement's reach. Half of a $6 billion theft, intercepted mid-flight.

Now here's the detail everyone will skim past.

The $1.2 billion isn't new money. It comes out of the roughly $2.85 billion Binance said on Nov. 3 had already been frozen or intercepted. Thursday's court order is the legal step that lets the government move toward taking ownership through forfeiture. Before that, the coins were just sitting there, parked at token issuers, frozen but unclaimed.

And there's a second track running in parallel that deserves its own paragraph.

Binance says it already covered the full $6.34 billion hit, replacing the lost tokens out of company funds. Not from recovered coins. From the Secure Asset Fund for Users, a slice of its futures insurance fund, and its own treasury. Users got made whole in days. The FBI is still chasing the money.

What This Actually Proves

Two things. Both are bullish.

First, public blockchains are the most surveillable financial rails ever built. North Korea is converting the stolen assets primarily into ether, per the FBI's Oct. 31 Cyber Alert, and still pushing them through bridges, mixers and exchanges. But the trail didn't vanish. Investigators followed it to the tune of $2.7 billion in about a week. Try that with bearer bonds.

So if the chain is this traceable, why does anyone still call crypto a criminal's playground? The criminals are the ones getting caught.

Second, and this one's less comfortable for the industry: Binance absorbed a $6.34 billion hole and didn't flinch. that's the largest customer reimbursement in crypto history, paid out of insurance funds and treasury rather than recovered loot. It's a hell of an advertisement for the exchange. It's also a reminder that every user holding coins on a platform is trusting a balance sheet they can't audit.

Let me say this plainly: the winners here are the people who understand counterparty risk and manage it, not the ones who pretend it doesn't exist.

Think about the scale of what we're watching. A state actor with a military payroll and a weapons program running on stolen crypto just got its cash flow interrupted by a court order in a jurisdiction it doesn't recognize. Principal Deputy Assistant Attorney General M. Scott Proctor put the motive on the record. North Korea's regime bankrolls itself and its illicit weapons program through crypto theft. That's not a hobby. That's a revenue line.

The asymmetry is staggering. They need one successful phish. The good guys need one clean trace, one subpoena, and one judge willing to sign.

The recovery work is being run by the FBI's Los Angeles Field Office, its Cyber Division and Virtual Asset Unit, alongside the Secret Service and IRS Criminal Investigation. Notably, the DOJ didn't break out how much of the $2.7 billion, or of the $1.2 billion under court authority, is bitcoin. Read into that what you want. My read is they don't know yet, and they're not going to guess in a press release.

The Call That Empties Wallets

Separately, and this is the part that should scare retail more than any exchange hack, the U.S. attorney's office in the Central District of California and the FBI seized cloud infrastructure tied to a social engineering operation the bureau calls FaceStealer.

More than $400 million in crypto stolen over the last 18 months. From people. Individual humans, sitting at their own desks, clicking their own mice.

The method is a fake video call. Hackers tied to North Korea, tracked publicly as APT38 and BlueNoroff, send meeting invites from accounts stolen off earlier victims. You join. You see a prerecorded webcam clip of someone you know, or a deepfake of a well-known face in the crypto industry. Then a technical error pops up. Then a fix gets offered. The fix installs malware.

The meetings run on imposter versions of Zoom, Microsoft Teams and Google Meet. The invites ride in through hijacked Telegram, LinkedIn, Slack and Discord accounts. Familiar tools, familiar names, wrong everything.

Under a federal warrant, the FBI seized more than 900 webcam videos of victims. Nine hundred people filmed without knowing it, their faces sitting in a server somewhere waiting to be used on the next mark.

And the timing is the cruel part. In several cases the theft landed months, sometimes more than a year, after the initial compromise. The hackers got in early and waited for the wallet balances to compound. That's patience weaponized.

So what's the takeaway in all of this? Government lawyers can freeze a billion dollars of stolen coins. They can't unfreeze a transfer you authorized yourself after a convincing video call.

The security stack for the next few years isn't a hardware wallet and a seed phrase in a safe. It's a second channel. Call the person back on a number you already had. Ask a question only they'd know. Treat every unsolicited meeting link like an inbound pitch from a stranger, because that's exactly what it's.

Long Bitcoin, long patience. And long diligence. The people who lose money in this cycle won't be the ones who bought the top. They'll be the ones who showed up to the wrong meeting.