Seizing North Korea's Binance Loot Starts a Fight Over Who Gets Paid

This updates my assessment of why North Korea is sitting on US$3 billion nobody can freeze. More than US$1.2 billion stolen from Binance is now trapped under US court authority. North Korea cannot move it. Binance cannot yet reclaim it. The Justice Department does not say which courts granted that authority, which assets it covers, or how much was seized into government custody rather than restrained where it already sat.

The authorization arrived two days after that assessment ran. It reaches part of more than US$2.7 billion frozen through government and private sector action. Customer restitution is complete, while recovery has barely begun. The frozen money has entered a legal contest Binance is not guaranteed to win.

None of it touches the assets North Korea very likely still controls. Elliptic’s running analysis, updated November 13, counts around US$2.8 billion still in addresses linked to the theft. The 18,270 stolen bitcoin have not moved since October 29. Nine Ethereum addresses holding 89 percent of the threat actor’s ETH have remained still since October 30.

What Court Authorization Changes

“Seize or restrain” covers two different legal acts. A seizure moves assets into government control. A restraint keeps them where they sit while forfeiture proceeds. Stablecoin Insider found no published forfeiture filing naming the assets. The Justice Department identifies three participating offices but never says whether its authorization came through one sealed order or several proceedings.

The authorization may formalize freezes stablecoin issuers already made. Tether Chief Executive Paolo Ardoino put its freeze at nearly US$1.57 billion in USDT, Finance Magnates reported on October 30. Circle initially reported more than US$800 million in USDC. Circle’s November 5 account raises its figure to approximately US$1.1 billion. Together the two issuers account for close to the US$2.7 billion the department describes as frozen.

Formal legal process matters most to the issuers. Circle quietly added a policy exception in May, after the Drift exploit, allowing urgent freezes requested by law enforcement before a court acts, American Banker reported. Circle now wants an appropriate legal safe harbor and says it does not decide who owns frozen assets. Judicial authorization places the restraint on a court’s authority rather than an issuer’s discretion. It does not eliminate every legal or operational risk the issuer carries.

The department’s own description stretches the record. Assistant Attorney General A. Tysen Duva credited the Criminal Division with moving to “immediately halt about half of this historic breach.” Law enforcement coordination was real, and Circle says it froze funds in coordination with authorities. The speed came from issuers controlling freeze functions over stablecoins, which made up 54 percent of the theft. The intervention demonstrates the reach of those controls more clearly than it measures the quality of the response.

The gap between US$2.7 billion frozen and US$1.2 billion covered by judicial authorization has no public explanation. Three possibilities fit the available record.

Hypothesis 1, Phased Legal Process

Prosecutors may have obtained authority first over assets with the clearest documentation and a domestic issuer. Circle’s US$1.1 billion, held by a US company already cooperating with law enforcement, sits close to the US$1.2 billion figure. The department also says tracing and recovery continue. I hold phased legal action at moderate confidence.

Hypothesis 2, Separate Resolution With Tether

Tether’s frozen USDT may resolve outside the same forfeiture process through reissuance to Binance or separate legal authority. Tether is incorporated outside the United States and controls frozen balances through its own blacklist and reissuance process. Nothing public confirms either path for the Binance assets. I hold a separate Tether resolution at low confidence.

Hypothesis 3, Deliberate Ambiguity

The department may have withheld the courts, cases, and asset breakdown to protect ongoing tracing or preserve several forfeiture options. Sealed proceedings explain the silence without requiring a deliberate communications strategy. I hold deliberate ambiguity at low confidence.

Who Gets Paid

Three legal paths now point toward the same money. Binance is the obvious first. It finished replacing the US$6.34 billion in affected customer assets this week using its Secure Asset Fund for Users (SAFU), part of its futures insurance fund, and its corporate treasury, DigitalToday reported. Remission of forfeited property to a victim is discretionary under 28 CFR 9.8, and the rule excludes a victim compensated by the perpetrator or others.

Binance’s customers no longer carry the uncompensated loss because the exchange made them whole. Binance absorbed the replacement cost, making it the natural party to assert ownership or seek remission. The department has returned North Korean theft proceeds before. In November 2025, it sought forfeiture of US$15.1 million in USDT traced to 2023 exchange thefts for eventual return to the victims.

The second path begins with a ruling about cigarettes. On August 4, the US Court of Appeals for the District of Columbia Circuit decided Englehardt v. Blanche. British American Tobacco had paid approximately US$653 million in penalties, forfeitures, and interest after admitting sanctions and bank fraud conspiracies involving North Korea. The department placed only a fraction in the United States Victims of State Sponsored Terrorism (USVSST) Fund. The court ordered all proceeds from both conspiracies into the Fund.

The Fund’s reach is narrower than state attribution alone. Its funding provision, summarized by the Congressional Research Service, covers proceeds from violations of the International Emergency Economic Powers Act (IEEPA) and the Trading with the Enemy Act (TWEA), the two laws underpinning most US sanctions. It also covers related conspiracies, schemes, or other federal offenses carrying the required connection to a state sponsor of terrorism. Attribution to members of the North Korean military establishes the state connection. It does not reveal the required relationship between the forfeiture offense and sanctions law.

That relationship may exist inside the sealed legal process. North Korean interests in property are extensively blocked under US sanctions, and laundering the stolen assets may produce an IEEPA theory. Nothing public identifies the offense supporting the authorization. If prosecutors pursue a qualifying civil forfeiture, 75 percent of the covered proceeds could enter the Fund. I hold that outcome at low confidence until the complaint, warrant, or forfeiture statute becomes public.

Englehardt still makes the prosecutorial choice consequential. Once a conspiracy qualifies, the ruling sends all of its proceeds into the Fund rather than a share. It does not bring every asset associated with North Korea into the statute, and a restrained wallet has not reached qualifying forfeiture. Binance can contest any forfeiture as the owner of stolen property. If the assets are forfeited under a qualifying theory, no court has yet decided whether a remission petition or the statutory deposit comes first, and the opinion does not address victims at all.

The third path belongs to the creditor group my earlier assessment followed into Arbitrum’s governance forum. Charles Gerstein’s clients hold roughly US$877 million in unpaid terrorism judgments against North Korea. In May, they argued frozen Kelp DAO ETH was North Korean property. General creditors usually lack standing to contest a civil forfeiture because they hold no interest in the specific property seized, as the Ninth Circuit held in United States v. $20,193.39. The same creditors could eventually receive distributions through the Fund if the Binance proceeds qualify.

The Arbitrum assets remain outside this contest for now. Binance’s request to release 8,425.997 ETH and 74,559,805.2 ARB still awaits governance approval. The proposal will not go on-chain until Binance signs indemnification agreements and no blocking legal process remains, and the department’s announcement does not say whether its authorization reaches these assets. Bybit chose another route after its own loss. It sued North Korea in the District of Columbia and obtained a preliminary injunction covering about US$30.5 million frozen across more than 28 exchanges and custodians. Binance has announced no similar suit.

Binance remained under the compliance monitorship imposed by its 2023 plea agreement as of April. Senator Richard Blumenthal pressed Acting Attorney General Todd Blanche about it after reporting on Iran-linked sanctions evasion through the exchange. President Donald Trump pardoned founder Changpeng Zhao in October 2025, a decision Representative Sean Casten and 27 other House Democrats condemned. Nothing public shows either history will affect recovery. Both will shape how any decision is received.

Beyond the Courtroom

The department announced the Binance authorization beside a separate disruption. Prosecutors in the Central District of California seized cloud infrastructure supporting FaceStealer, which the FBI ties to more than US$400 million in theft over 18 months. The department attributes FaceStealer to North Korean threat actors known by several names, including STARDUST CHOLLIMA (aka BlueNoroff, Sapphire Sleet). CrowdStrike separates that activity from PRESSURE CHOLLIMA, the adversary the FBI names as TraderTraitor and the Binance theft.

The pairing supports a whole-of-state message about North Korean cyber finance, but public affairs timing offers another explanation. The department expressly describes the operations as separate. Nothing released publicly establishes shared infrastructure, personnel, tasking, or operational control between FaceStealer and the Binance intrusion. The announcement places them inside one national security narrative without proving they belong to one campaign.

FaceStealer begins with a video call. The threat actor plays previously recorded footage of someone the target trusts, then prompts a fake technical fix installing malware. The FBI seized more than 900 victim webcam videos under a federal warrant. The collection can reveal whose identities North Korea gathered, which relationships it exploited, and how its targeting moved through professional networks. The FBI says genuine stolen footage still overwhelmingly supports the scheme despite emerging deepfake use.

The seized videos are also an unfinished victim list. In several cases, the threat actors waited from a few months to more than a year for wallet balances to grow before emptying them, Help Net Security reported. Each recording may identify a device, communications account, employer, software repository, and contact network still exposed to follow-on activity. The intelligence value depends on identifying and warning those people before North Korea replaces the infrastructure the FBI removed.

Publicity carries a counter-intelligence cost. Each announced intervention tells North Korea which assets the United States can reach and which intermediaries will act. Its principal bitcoin and ether holdings stopped moving well before the announcement, and the dormancy fits several explanations. The threat actor may be waiting for surveillance to decline, avoiding losses from moving enormous positions, or waiting for laundering capacity. A dormant balance still denies analysts the counterparties a transaction would expose.

The stolen portfolio also reflected what Binance held. North Korea did not necessarily choose to take 54 percent of the theft in stablecoins. Future adaptation may appear through different target selection, conversion routes prepared before the theft, or faster swaps after access.

The diplomatic timing cuts both ways. On November 3, Kim Yo Jong called the FBI’s attribution “absurd rhetoric” and “a grave political provocation,” Reuters reported. She said North Korea had issues to reconsider as Trump offered to resume summit diplomacy. Nine days later, the National Security Division pledged to seize and return North Korea’s ill-gotten gains. Washington can present enforcement as leverage before talks. Pyongyang can present it as proof talks are pointless.

From Pyongyang’s perspective, the authorization reaches money the regime lost within minutes and could never spend. The threat actor converted about US$786 million in stablecoins before issuer freezes landed. Elliptic assesses the unmoved bitcoin and ether are very likely still controlled by North Korea. Laundering continues at a slower pace, with roughly 4,100 BTC converted from other stolen assets and about 11,000 ETH sent through Tornado Cash since November 8. Elliptic assesses only a negligible amount has been cashed out.

The remaining recovery problem may eventually run through China. Elliptic says funds already moving may have reached Chinese money laundering networks. It expects eventual cash-out through over-the-counter (OTC) brokers, following the pattern observed after the Bybit theft. Washington can trace those movements and pressure centralized services. It cannot directly compel an informal broker operating beyond a cooperating jurisdiction.

Chinese infrastructure does not establish direction or approval by Beijing. The same activity could reflect tolerated sanctions evasion, ordinary corruption, enforcement failure, or a network operating against Chinese law. Evidence connecting specific brokers, banking rails, exchange accounts, or officials to the laundering would change that assessment. Until then, China is the likely geographic choke point and an unresolved counterparty rather than an attributed participant.

My earlier assessment closed on the intermediaries standing between North Korea’s wallets and anything the regime wants. The court authorization adds another set between the frozen money and anyone who wants it back. A prosecutor defines the forfeiture theory. A remission official weighs Binance’s petition. If that theory rests on sanctions law, a ruling about cigarette sales decides whether the proceeds must help compensate victims of state sponsored terrorism. The remaining US$2.8 billion stays out of practical reach while it sits in self-custodied bitcoin and ether addresses. Every exchange, broker, bridge, and government along its eventual path will face the same choice the issuers faced on October 29.

I assess with low confidence the USVSST Fund will receive proceeds from these assets. I assess with moderate confidence the government’s forfeiture theory will materially shape whether Binance recovers the assets Washington controls.