By Amara Osei

The U.S. Justice Department obtained court authorization on Thursday to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, the department said.

The action addresses part of a larger operation that the Justice Department attributes to members of the North Korean military, whom the FBI identifies as “TraderTraitor” (the designation for the accused actors). Those actors stole more than $6 billion in virtual assets from the exchange on or about Oct. 29.

What does the court authorization cover?

U.S. and private-sector investigators have frozen more than $2.7 billion of those funds, according to the department. The $1.2 billion sits within that total, rather than representing a separate recovery. The authorization gives prosecutors a court-backed mechanism over more than $1.2 billion already frozen through coordinated government and private-sector work.

Principal Deputy Assistant Attorney General for National Security M. Scott Proctor said: “North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft.” He added: “The National Security Division will use every tool at its disposal to seize and return North Korea's ill-gotten gains.”

Assistant Attorney General A. Tysen Duva of the Criminal Division said the division and its law-enforcement partners froze about half of the stolen assets before the funds moved out of reach. U.S. Attorney Jeanine Ferris Pirro for the District of Columbia said the seizure of more than $1.2 billion showed the government had confronted the North Korean regime directly.

The figures distinguish the broader freeze from the specific court action. Investigators have frozen more than $2.7 billion from a theft exceeding $6 billion, while Thursday's court action covers more than $1.2 billion of that total.

How are the stolen funds being moved?

The Justice Department said its efforts to trace, freeze, seize and forfeit the assets remain underway. It said TraderTraitor actors continue to launder the proceeds through cryptocurrency bridges, mixers and exchanges.

Last week, the FBI, the U.S. Secret Service and the Internal Revenue Service's criminal investigation unit issued a joint Cyber Alert attributing the theft to TraderTraitor. The alert urged virtual asset service providers to block transactions with, or derived from, addresses the actors use to launder the Binance funds.

The alert, issued by three U.S. agencies last week, broadens the enforcement response from court-backed seizure to prevention of further transfers tied to identified laundering addresses. It also extends the operational focus beyond the more than $1.2 billion covered by Thursday's authorization, because the alert directs private providers to block transactions across addresses linked to the Binance funds.

What happens after the assets are seized?

The Associated Press reported that government seizures in such cases typically lead to a forfeiture claim (a court filing seeking a ruling on rightful ownership). A judge then determines which parties are legitimately entitled to the recovered money, making the forfeiture stage distinct from the authorization to seize or restrain assets.

The Justice Department said the work to trace, freeze, seize and forfeit the assets continues as TraderTraitor actors persist in laundering. The sequence matters because court authority covers more than $1.2 billion of identified holdings, while transaction blocking targets routes used to launder the Binance proceeds.

What else did the Justice Department disrupt?

The department also announced the disruption of cloud-based infrastructure used in a North Korean scheme the FBI calls “FaceStealer” (its designation for the malware operation). The scheme uses recorded videos and deepfakes to lure targets into fake video meetings and install malware, according to the Justice Department.

The Justice Department said FaceStealer had caused victims to lose more than $400 million in digital assets during the past year and a half. The more than $1.2 billion court action and the separate FaceStealer infrastructure disruption target two distinct North Korean digital-crime operations.