DOJ Wins Court Authority to Seize $1.2 Billion Stolen in Binance Hack as FBI Disrupts North Korean FaceStealer Scam

admin · November 12, 2026 · 6 min read

Digital vault with cryptocurrency coins and a broken chain illustrating the DOJ seizure of $1.2 billion stolen from Binance

The U.S. Department of Justice has won court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, the largest crypto exchange heist ever recorded, as federal investigators move to claw back funds tied to North Korean hackers.

The department announced the action on Thursday, November 12, alongside a second blow against Pyongyang’s cybercrime operations: the FBI seized cloud infrastructure behind a deepfake video-meeting scam known as FaceStealer, which investigators say stole more than $400 million over the past 18 months.

A $6.3 billion heist, and a $2.7 billion freeze

The Binance theft took place on October 29, when attackers drained more than $6 billion in virtual assets from the exchange. Binance later put the value of the affected assets at about $6.34 billion. The FBI has attributed the attack to TraderTraitor, a hacking operation linked to North Korea’s military that is also connected to the Lazarus Group.

Since the theft, U.S. investigators working with private companies have frozen more than $2.7 billion of the stolen funds. The court authorization announced Thursday covers more than $1.2 billion of that frozen total. It is a legal step toward forfeiture, not newly recovered money: the assets had already been frozen, and court proceedings to determine their final disposition are still underway.

“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” M. Scott Proctor, the Justice Department’s principal deputy assistant attorney general for national security, said in a statement. “Today’s announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime.”

Assistant Attorney General A. Tysen Duva said the department and its partners were able to “immediately halt about half of this historic breach” by freezing stolen assets before they moved beyond law enforcement’s reach. Investigators are still tracing funds moving through blockchain bridges, mixers and exchanges, seeking to freeze and recover more.

The FaceStealer deepfake scheme

The second operation targeted a social engineering campaign that federal officials say is just as dangerous as a direct hack. FaceStealer lures victims — typically people working in cryptocurrency and web3, along with open-source software developers — into fake video meetings that appear to be Zoom or Microsoft Teams calls.

The invitations arrive from hijacked accounts the target may recognize. When the victim joins, they see a prerecorded video of a trusted contact, sometimes enhanced with AI-generated deepfakes, but hear no audio. A message in the chat claims there is a technical problem and instructs the victim to install software or run a command to fix it. That “fix” installs malware that steals cryptocurrency and sends the victim’s contact list to the attackers, seeding the next round of invitations.

The FBI said it seized more than 900 webcam videos the attackers had secretly recorded from tech workers, and took down the cloud infrastructure running the scheme. The bureau attributes FaceStealer to Sapphire Sleet, a North Korea-linked group also tracked as UNC1069 and widely regarded as a Lazarus Group offshoot.

“North Korean hackers are increasingly blending cyber intrusion, social engineering, and emerging technologies such as deepfakes to make their impersonation efforts more convincing and scalable,” Brett Leatherman, assistant director of the FBI’s Cyber Division, told reporters.

How the Binance attack unfolded

Binance said last week that the attackers laid the groundwork for their “sophisticated, multi-stage campaign” as far back as June. The operation involved social engineering during fake job interviews, malware downloads, compromised internal AI tooling, endpoint takeover, and what the company called an “advanced transaction-authorization method.”

The exchange has said it fully covered user losses from its own funds, replacing the affected tokens rather than waiting for stolen coins to be recovered. Tether, the largest stablecoin issuer, reported freezing more than $1.5 billion in USDT within 30 minutes of the October 29 incident.

Why this matters

The dual announcement shows how central cryptocurrency theft has become to North Korea’s finances — and how the U.S. response now spans both courtrooms and server takedowns. The $1.2 billion authorization is the largest single recovery step since the Binance heist, but it still leaves more than half of the stolen funds unaccounted for, and forfeiture proceedings could take months.

It also caps a month of major cyber incidents. Hackers stole AI keys from 100,000 Railway workspaces (https://nnews.pro/railway-hack-ai-keys-100000-workspaces-740000-fraud/), Silent Lynx used an AI agent to steal Tajik government documents (https://nnews.pro/silent-lynx-ai-agent-steals-tajik-government-documents/), and Google patched its eighth actively exploited Chrome zero-day of 2026 (https://nnews.pro/google-patches-eighth-chrome-zero-day-2026/). In crypto markets, MSCI dropped Strategy from its global indexes over its bitcoin-heavy balance sheet (https://nnews.pro/msci-drops-strategy-global-indexes-bitcoin/), a sign of how deeply the sector’s risks now reach into mainstream finance.

For ordinary crypto users, the FaceStealer takedown is a reminder that the most dangerous attacks no longer arrive as suspicious emails. They arrive as calendar invites from people you know, with a familiar face on screen and a plausible request to fix your audio.

Latest developments

The Justice Department said efforts to seize the assets and secure their forfeiture are continuing, and the FBI’s Los Angeles Field Office is leading the Binance recovery effort with the Secret Service and IRS Criminal Investigation. The department has not said how much of the $1.2 billion under court authority is bitcoin, or whether any of the funds have been returned to victims.

Frequently Asked Questions

How much was stolen in the Binance hack?

More than $6 billion in virtual assets, according to the FBI. Binance estimated the value of the affected assets at about $6.34 billion, making it the largest cryptocurrency exchange theft on record.

Does the $1.2 billion seizure mean the money has been recovered?

Not yet. The court authorization lets the government seize or restrain more than $1.2 billion in assets that were already frozen. Forfeiture proceedings are still underway, and the funds have not been returned to victims. Binance has already covered user losses from its own funds.

Who is behind the Binance hack?

The FBI attributes the attack to TraderTraitor, a hacking operation linked to North Korea’s military and also connected to the Lazarus Group. The FaceStealer scheme was attributed to Sapphire Sleet, another North Korea-linked group.

How does the FaceStealer scam work?

Victims receive an invitation to a fake video meeting from a hijacked account. They see a prerecorded or deepfake video of a trusted contact, are told there is an audio problem, and are instructed to install software that is actually malware designed to steal cryptocurrency.

What to watch next

Investigators will keep tracing the remaining stolen funds through mixers and exchanges, and the forfeiture case will determine whether the $1.2 billion under court authority is ultimately returned to victims or forfeited to the government. The FaceStealer takedown may also reveal how many developers and crypto workers were targeted, and whether the stolen webcam footage was used in other campaigns.