DOJ Seizes $1.2 Billion of North Korea's Stolen Binance Crypto in FaceStealer Crackdown

The United States Justice Department has won court authority to seize more than $1.2 billion in cryptocurrency stolen from Binance by North Korean hackers, in the biggest recovery move yet from the record $6.3 billion heist of October 29. Announced on Thursday, November 12, it also shut down FaceStealer, a separate North Korean deepfake scam that used fake video calls to steal more than $400 million from crypto workers in 18 months — Washington's sharpest counterstrike yet against Pyongyang's cybercrime machine.

Key Points

• The Justice Department obtained court authorisation to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance.
• United States government and private-sector efforts have now frozen more than $2.7 billion of the roughly $6.3 billion stolen on October 29.
• The FBI seized cloud infrastructure behind FaceStealer, a deepfake video-call scam that has stolen more than $400 million in 18 months.
• Agents recovered more than 900 secretly recorded webcam videos of FaceStealer victims.
• Binance said on November 12 it has fully covered affected customer balances from its own funds.

What Happened

The Justice Department announced the coordinated actions on Thursday, November 12, describing two separate blows against North Korea's cryptocurrency theft operations. Prosecutors obtained court authorisation to seize or restrain more than $1.2 billion in digital assets stolen from Binance, the world's largest cryptocurrency exchange. The money sits inside the more than $2.7 billion that American officials and private companies have frozen since the theft, and forfeiture proceedings are under way to take permanent control of it.

The effort involved the Justice Department's National Security Division, its Criminal Division's computer crime section, the United States Attorney's Office for the District of Columbia, and partners working with virtual asset service providers to trace and block the funds. The FBI, the Secret Service and the IRS criminal investigations unit issued a cyber alert last week attributing the theft and urging exchanges to block transactions linked to the laundering addresses.

Background: The $6.3 Billion Binance Heist

The theft took place on October 29, when hackers the FBI calls TraderTraitor drained more than $6 billion worth of virtual assets from Binance in about 20 minutes, making it the largest cryptocurrency heist on record. Binance later revealed that the hack began with a fake job interview, and early findings pointed to a compromised DevOps engineer's laptop that let an attacker reach a service container and submit unauthorised withdrawals.

Customers rushed to pull funds, with net outflows of about $3.64 billion in the days after the attack, and Binance reopened withdrawals in phases, the second starting on November 3. Chief financial officer Kaiser Ng stepped down a week after the hack, and North Korea denied any role on November 3, with Kim Yo Jong calling the FBI's TraderTraitor attribution "absurd rhetoric". Binance said on November 12 it had finished covering affected customer balances from its own resources and protection funds.

The DOJ Binance Crypto Seizure: How the Money Was Traced

Freezing stolen cryptocurrency is a race against time, because thieves move funds through bridges, mixers and exchanges to hide their trail. The Justice Department said TraderTraitor actors are still laundering the Binance assets through those channels, so the tracing, freezing, seizure and forfeiture work continues, coordinated by the FBI's Los Angeles Field Office, its Cyber Division and its Virtual Asset Unit with the Secret Service and the IRS.

Officials stressed the $1.2 billion under court order is part of the $2.7 billion already frozen, not an additional sum. Assistant Attorney General A. Tysen Duva said the Criminal Division "quickly and efficiently used its expertise to immediately halt about half of this historic breach."

Reactions and Quotes

Justice Department officials framed the announcement as a direct challenge to North Korea's use of cybercrime to fund its regime. "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," said M. Scott Proctor, Principal Deputy Assistant Attorney General for National Security. "Today's announcement shows that America will fight back against that corrupt regime's effort to profit through cybercrime."

United States Attorney Jeanine Ferris Pirro said the seizure showed American investigators had matched the hackers step for step. "The North Korean regime may think they are sophisticated cyber criminals, but we have consistently met them head on, as we did here seizing more than $1.2 billion of their stolen assets," she said.

On FaceStealer, the FBI warned the scam is unusually convincing. "North Korea's FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user," said Patrick Grandy, Assistant Director in Charge of the FBI's Los Angeles Field Office. "It exploits our trust in ubiquitous video conference platforms and valued personal relationships."

Why It Matters

North Korea has turned cryptocurrency theft into a pillar of state finance: the FBI says the regime relies on proceeds from large-scale crypto theft to fund its illicit weapons programme, stealing billions of dollars in recent years. Every dollar frozen or seized is one that cannot buy missile parts, pay hackers or sustain the networks behind the thefts.

The FaceStealer takedown matters for a different reason: it targeted people, not just wallets — workers in cryptocurrency and Web3, and increasingly people who build and maintain open-source software, in what the FBI says looks like preparation for supply-chain attacks. A compromised maintainer could open the door to thousands of downstream users, so disrupting the scheme protects far more than the victims already robbed.

What Happens Next

Forfeiture proceedings for the $1.2 billion are under way, and investigators keep tracing the remaining assets as TraderTraitor actors move them through bridges, mixers and exchanges. The FBI has published a detailed report on how FaceStealer works, with best practices to protect against it and steps for victims, and has created a hub at fbi.gov/facestealer.

For Binance, the immediate crisis is easing: customer balances are covered and withdrawals have resumed. The longer question is whether the industry can close the gaps the heist exposed, from fake job interviews to compromised employee laptops, before North Korea's hackers strike again.

Frequently Asked Questions

How much cryptocurrency did North Korea steal from Binance?

More than $6 billion worth of virtual assets, taken on October 29 in about 20 minutes — the largest cryptocurrency heist on record.

How much of the stolen crypto has been frozen or seized?

More than $2.7 billion has been frozen, and the Justice Department has court authorisation to seize or restrain more than $1.2 billion of that amount.

What is the FaceStealer scheme?

A North Korean social engineering scam that uses fake video calls and deepfakes to trick crypto and Web3 workers into enabling their webcams, secretly records them, then uses a phoney "audio error" to install malware. It has stolen more than $400 million in 18 months.

Who is TraderTraitor?

The name the FBI gives to a hacking operation tied to North Korea's military, blamed for the October 29 Binance theft and for laundering the stolen assets.

Did Binance customers lose money in the hack?

Binance said on November 12 it has finished covering affected customer balances using its own resources and protection funds.