DOJ targets $1.2B from record Binance hack as seizure push grows

The record $6.4 billion Binance hack — attributed by the FBI to North Korea's TraderTraitor group — began with a fake job interview, with attackers spending months compromising employees and internal systems before hitting hot-wallet signing infrastructure via Ethereum's EIP-7702, Binance says. On Nov. 12, the DOJ said it has court authority to seize $1.2 billion of the stolen funds, with U.S. authorities and private firms having frozen more than $2.7 billion of the haul overall.

Binance reopened withdrawals Nov. 1 after a 45-hour freeze, absorbed the losses and replenished roughly 95% of the stolen assets; stablecoin issuers froze over $2.4 billion. In a related action, agents seized cloud infrastructure used in the North Korean FaceStealer scheme, which the FBI says stole more than $400 million over 18 months through deepfake video-conferencing lures.

• Co-founder CZ warned AI tools are lowering the barrier for complex breaches; Kim Yo Jong denied North Korea's involvement.
• Arbitrum's Security Council moved about $30 million out of the exploiter's address, unlockable only by an ArbitrumDAO vote.
• More than $6 billion has left Binance-linked wallets since the theft.