US Seizes $1.2 Billion in Crypto Stolen From Binance in Crackdown on North Korean Hackers

admin · November 13, 2026 · 8 min read

Illustration of a digital vault and a network of cryptocurrency tokens under a magnifying glass, representing the FBI seizure of stolen Binance funds

The United States has won court approval to seize more than $1.2 billion in cryptocurrency stolen from Binance by North Korean military hackers, the Justice Department announced on Thursday, in the biggest recovery effort yet from the largest crypto theft in history. In a separate action the same day, the FBI seized cloud infrastructure behind a North Korean social engineering scheme that used fake video calls to steal more than $400 million over 18 months.

The Binance heist: what happened

According to the Justice Department, members of the North Korean military — tracked by the FBI under the name TraderTraitor — stole more than $6 billion worth of virtual assets from Binance on or about October 29. Binance itself has put the loss at about $6.34 billion, based on on-chain data. Either figure makes it the largest cryptocurrency heist on record, surpassing the $1.5 billion stolen when the Bybit exchange was targeted last year.

The theft was completed in less than 20 minutes, according to reports of the attack, and the hackers immediately began moving the funds through cryptocurrency bridges, mixers and exchanges to obscure their trail. The Justice Department said TraderTraitor actors are still laundering the stolen assets, and that tracing, seizure and forfeiture work continues.

Binance said it had already covered the assets hit in the breach, replacing the tokens from company funds rather than relying on recovering the stolen coins. That means customers were not left out of pocket while the investigation unfolded.

More than $2.7 billion frozen — and $1.2 billion now under court order

Combined efforts by the U.S. government and private-sector partners have frozen more than $2.7 billion of the stolen funds so far. The Justice Department said it has now obtained court authorization to seize or restrain more than $1.2 billion of that amount — the legal step that lets the government move toward taking ownership of the funds through forfeiture.

The $1.2 billion is part of the frozen total, not an additional sum on top of it. Assistant Attorney General A. Tysen Duva, who leads the Justice Department’s Criminal Division, said its computer crime section and partners froze the stolen Binance assets "before they got beyond law enforcement reach," adding that the department had "immediately halted about half of this historic breach."

The recovery effort is being run by the FBI’s Los Angeles Field Office, Cyber Division and Virtual Asset Unit, working with the U.S. Secret Service and IRS Criminal Investigation. The Justice Department’s announcement did not name the court or judge that signed the orders, and the underlying court papers had not been posted publicly as of Thursday. Typically in such cases, the government will file a forfeiture claim with a judge, who then determines who has a legitimate claim to the recovered funds.

On-chain data cited by crypto analysts suggests roughly $2.85 billion of the stolen funds remains accessible to the hackers, so the recovery effort is far from over. North Korea has denied any involvement in the theft.

FaceStealer: the $400 million deepfake video-call scam

Separately from the Binance case, the U.S. Attorney’s Office for the Central District of California and the FBI announced the seizure of cloud-based infrastructure used in a North Korean social engineering campaign the FBI calls FaceStealer. Officials say the scheme has stolen more than $400 million in cryptocurrency over the past 18 months.

The scheme worked by hijacking accounts on messaging platforms including Telegram, LinkedIn, Slack and Discord, then inviting targets to video meetings from the stolen accounts. During the calls, the hackers played secretly recorded webcam videos — or deepfakes — of people the victims knew and trusted, to convince them to hand over credentials or approve transfers. Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims that the hackers kept in a library for impersonating them in follow-up attacks.

The FBI attributes FaceStealer to a North Korean-linked group tracked as Sapphire Sleet, also known under the names UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima — widely regarded as an offshoot of the Lazarus Group. The bureau also said the campaign was used in attempts to compromise people who maintain open-source software, a step officials said appears calculated to enable supply-chain attacks.

The FBI has published a detailed report on how the scheme works, including best practices to protect against it and steps victims can take after a compromise, and created a central resource hub at fbi.gov/facestealer. The bureau credited cybersecurity firms Arctic Wolf, Jumpsec and Microsoft Threat Intelligence Center for assisting in the investigation and seizure.

Why this matters

The twin announcements mark the most aggressive public U.S. response yet to North Korea’s crypto-theft machine, which American officials have long accused of bankrolling the regime’s weapons programs. The Binance heist alone was roughly four times the size of the previous record theft, and the speed with which more than $2.7 billion was frozen shows how far public-private cooperation in tracing stolen crypto has come.

For ordinary crypto users, the FaceStealer takedown is arguably the more important development. It exposed a social engineering playbook — stolen accounts, fake meeting invitations, pre-recorded video of real people — that can defeat the caution of even experienced professionals. The FBI’s public report and resource hub are aimed squarely at helping companies and individuals recognize the pattern before they become the next victim.

The case also lands at a moment of strain for crypto markets. Bitcoin fell below $70,000 this week amid heavy selling and large outflows from spot bitcoin exchange-traded funds, and the Binance theft has added to questions about exchange security. Binance blocked transfers from MEXC earlier this month after a U.S. Treasury order cut that exchange off over alleged illicit flows, a separate enforcement action that showed Washington is tightening scrutiny across the crypto industry.

Latest developments

The Justice Department said both operations were announced on Thursday, November 12. The Binance investigation continues, with the FBI, Secret Service and IRS working to trace the remaining funds. The department said it will seek forfeiture of the seized assets through the courts, which will decide who has a legitimate claim to them.

It remains unclear whether FaceStealer played any part in the Binance breach itself. An FBI agent told one trade publication it was unclear whether the two operations were connected, and officials have described them as separate actions against the same broader North Korean theft campaign.

The announcements add to a busy week for U.S. cyber enforcement. Google patched its eighth Chrome zero-day of 2026 earlier this week, a reminder that the threats facing users range from state-backed hacking groups to flaws in the software billions of people use every day.

Frequently Asked Questions

How much cryptocurrency was stolen from Binance?

More than $6 billion in virtual assets, according to the Justice Department. Binance has put the figure at about $6.34 billion, based on on-chain data. It is regarded as the largest cryptocurrency heist in history.

How much has the U.S. recovered so far?

U.S. government and private-sector efforts have frozen more than $2.7 billion of the stolen funds. The Justice Department has obtained court authorization to seize or restrain more than $1.2 billion of that amount. The $1.2 billion is part of the frozen total, not an additional sum.

What is FaceStealer?

FaceStealer is the FBI’s name for a North Korean social engineering scheme that has stolen more than $400 million in cryptocurrency over 18 months. Hackers hijacked accounts on Telegram, LinkedIn, Slack and Discord, invited targets to video meetings, and played recorded webcam videos or deepfakes of trusted contacts to trick victims into handing over credentials or approving transfers.

Will Binance customers get their money back?

Binance said it already covered the assets hit in the breach from company funds, so customers were not left out of pocket. The seized funds will go through a court forfeiture process, where a judge will determine who has a legitimate claim to them.

Who is TraderTraitor?

TraderTraitor is the FBI’s name for a unit of the North Korean military blamed for the Binance hack. It is linked to the Lazarus Group, the North Korean hacking organization U.S. officials have repeatedly accused of stealing cryptocurrency to fund the regime, including its weapons programs. North Korea denies involvement.

What to watch next

Investigators will keep tracing the roughly $2.85 billion in stolen Binance funds that on-chain data suggests remains within the hackers’ reach, and the forfeiture proceedings for the $1.2 billion under court order will determine where that money ultimately goes. The FBI’s FaceStealer report is likely to prompt fresh warnings from crypto companies and employers about verifying video-call invitations — especially when they arrive from a familiar account asking for something unusual.

Sources: