US federal authorities and private-sector partners have frozen more than $2.7 billion in cryptocurrency stolen during a massive cyberattack by North Korean hackers targeting the Binance platform. Meanwhile, Binance has announced that it has fully covered the assets affected by the attack, which took place last month.
The US Department of Justice announced on Thursday that the frozen funds are part of more than $6 billion in digital assets stolen from Binance during the cyberattack on October 29, which was attributed to North Korean hackers.
Federal officials have also secured court authorisation to seize or block more than $1.2 billion of these assets, while investigators continue efforts to trace and recover the remaining funds stolen from Binance, the world’s largest cryptocurrency exchange.
Separately, Binance announced that it had completed the full reimbursement of assets affected by the security incident, whose overall impact is estimated at approximately $6.3 billion. The platform also published an updated proof-of-reserves report.
“To our users and community: thank you for your patience and understanding,” Binance wrote on the social media platform X.
Federal investigators attributed the theft to North Korean military hackers operating under the name “TraderTraitor”.
The Department of Justice said the group had stolen more than $6 billion in virtual assets from the platform on or around October 29, in what has been described as one of the largest cryptocurrency thefts ever recorded.
According to authorities, the hackers continued attempting to move the stolen funds through cryptocurrency exchanges, cross-chain blockchain bridges and transaction-mixing services, which are used to conceal the movement of digital assets.
“By acting immediately, we worked together to stop this massive criminal fraud at the outset,” US Attorney Jeanine Ferris Pirro said, adding that authorities had secured court authorisation to seize or block more than $1.2 billion in stolen assets.
Binance co-CEO Richard Teng had previously told FOX Business that the company had shut down the entry points exploited by the hackers and rebuilt the affected systems.
According to the platform, the attack began with a fake job interview during which an employee’s computer was compromised. The hackers then exploited internal systems to carry out unauthorised cryptocurrency transactions.
The update came as the US Department of Justice separately announced that investigators had disrupted a North Korean hacking operation known as “FaceStealer”, which authorities link to the theft of more than $400 million in cryptocurrency over the past 18 months.
According to the Department of Justice, the operation used fraudulent video calls, covert camera recordings and fake videos generated with artificial intelligence to trick victims into installing malware on their devices.
The FBI said the hackers posed as trusted individuals during video meetings before presenting victims with fake technical problems and persuading them to click on malicious links.
As part of the operation, federal investigators also seized more than 900 videos recorded through victims’ cameras.
The FBI warned that the scheme is increasingly targeting not only cryptocurrency investors and industry professionals, but also developers maintaining open-source software. Authorities say this could expose much broader technology systems to cyberattacks.
