U.S. authorities have taken control of over $1.2 billion in stolen cryptocurrency from the recent Binance hack, but the total frozen assets exceed $2.7 billion. The Justice Department's announcement on November 12 highlights that the $1.2 billion is part of this larger figure, not a separate sum. Binance has separately replaced affected assets using more than $6.34 billion in company funds, ensuring customers are covered without recovering the original stolen coins.
The FBI has linked the hack to North Korea’s TraderTraitor actors, estimating the stolen assets at over $6 billion. The recovery process involves freezing assets, resolving legal claims, and determining how to return them, with no clear timeline yet. Investigators have tracked the stolen funds primarily into Ether, warning of further laundering through decentralized finance and instant-swap services.
Separately, the FBI exposed a North Korean social-engineering campaign called FaceStealer, which caused over $400 million in theft over 18 months. The campaign involved hijacking communication accounts and using recorded webcam footage to deceive victims. The FBI seized over 900 victims’ webcam recordings, highlighting the broader threat to open-source developers and maintainers.
The Binance case underscores the challenges of recovering stolen crypto assets. While visibility on public ledgers helps track movements, it does not guarantee asset recovery. The next meaningful update should clarify newly frozen assets, progress toward final recovery, and whether funds have been returned to victims.