The FBI and Justice Department announced Thursday the seizure of more than $1.2 billion in cryptocurrency stolen from Binance, the world's largest crypto exchange, in a coordinated effort to disrupt North Korean government-backed cyber theft schemes.
The operation marks a significant move by U.S. authorities to counter North Korea's use of cryptocurrency theft to fund its regime and weapons programs. The Justice Department described the action as a major step in preventing North Korea from profiting through cybercrime and using those funds to advance its illicit activities.
North Korean hackers have increasingly targeted cryptocurrency platforms in recent years. According to U.S. officials, more than $6 billion was stolen from Binance last month alone. Of those stolen assets, over $2.7 billion was frozen by the U.S. government and private sector partners. The Justice Department then secured court authorization to seize or restrain more than $1.2 billion of the frozen funds, effectively removing a substantial portion of the assets from North Korean control.
North Koreaβs Cyber Theft Operations
According to the Justice Department, North Korea has relied on large-scale cryptocurrency theft to finance its illicit weapons program, stealing billions of dollars in recent years. Principal Deputy Assistant Attorney General for National Security M. Scott Proctor stated, "North Koreaβs government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft."
"Todayβs announcement shows that America will fight back against that corrupt regimeβs effort to profit through cybercrime. The National Security Division will use every tool at its disposal to seize and return North Koreaβs ill-gotten gains."
β M. Scott Proctor, principal deputy assistant attorney general for national security
The FBI identified North Korean cyber actors using sophisticated social engineering tactics, including the "FaceStealer" scheme. This scheme alone has resulted in the theft of more than $400 million in the last 18 months. The hackers, operating under names such as Sapphire Sleet, UNC1069, and APT38, have targeted individuals and organizations in the cryptocurrency and Web3 sectors. These groups are known for their advanced methods, often employing fake identities and deceptive online personas to gain access to sensitive systems and digital assets.
Assistant Attorney General A. Tysen Duva of the Justice Departmentβs Criminal Division credited the Criminal Division and law enforcement partners for their swift action. He said they "immediately froze billions of dollarsβ worth of stolen Binance digital assets before they got beyond law enforcement reach." This rapid response was crucial in preventing the stolen funds from being laundered or moved beyond the reach of authorities.
Ongoing Efforts and Broader Context
Efforts to trace, freeze, seize, and forfeit stolen virtual assets are ongoing, according to the Justice Department. The FBI stated it remains committed to identifying and disrupting North Korean actors targeting the virtual asset community. U.S. Attorney Jeanine Ferris Pirro for the District of Columbia emphasized, "By springing into action at a momentβs notice, we worked together to freeze this massive criminal fraud in its tracks."
The U.S. government has not publicly detailed the response from North Korean officials regarding the seizures. However, the Justice Department and FBI have indicated that they will continue to use all available tools to counter North Korean cyber operations targeting cryptocurrency platforms. This includes ongoing collaboration with international partners, private sector companies, and other law enforcement agencies to identify and disrupt future threats.
The seizure of over $1.2 billion in stolen cryptocurrency is part of a broader strategy by U.S. authorities to combat the growing threat of state-sponsored cybercrime. North Korea's persistent targeting of digital assets has raised concerns among global regulators and security experts. The U.S. government has repeatedly warned that proceeds from these cyber thefts are used to support North Korea's weapons development and other illicit activities, making the disruption of such operations a national security priority.
As digital assets become increasingly integrated into the global financial system, law enforcement agencies are adapting their strategies to address new forms of cyber-enabled crime. The Justice Department's actions against North Korean hackers demonstrate a commitment to protecting the integrity of the cryptocurrency market and preventing hostile regimes from exploiting technological vulnerabilities for financial gain.
The investigation into North Korea's cryptocurrency theft operations remains active, with authorities continuing to monitor suspicious activity and pursue additional leads. The Justice Department has encouraged victims of cryptocurrency theft to report incidents and cooperate with law enforcement to help recover stolen assets and bring perpetrators to justice.
