USD
DOJ Secures $1.2B Binance Hack Seizure Approval, Disrupts FaceStealer
U.S. authorities pursue North Korean stolen assets while dismantling infrastructure behind a separate video-call hacking campaign
TL;DR
- The U.S. Department of Justice obtained court approval to seize or restrain more than $1.2 billion stolen in the Binance hack.
- More than $2.7 billion has been frozen as authorities pursue funds linked to North Korea's TraderTraitor hacking group.
- Federal agents separately seized infrastructure used by FaceStealer, a campaign linked to over $400 million in cryptocurrency theft.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
The U.S. Department of Justice (DOJ) announced on November 12, 2026, that it had secured court approval to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance during a major cyberattack attributed to North Korean hackers. Federal authorities also disrupted a separate hacking operation known as FaceStealer, seizing cloud infrastructure used to impersonate trusted contacts through fraudulent video calls and steal digital assets.
DOJ Targets Billions Stolen From Binance by North Korean Hackers
The Binance attack occurred on October 29 and was attributed by the FBI to TraderTraitor, a North Korean military-linked hacking operation. U.S. authorities and private companies have since worked together to freeze stolen cryptocurrency, while investigators continue tracking funds moving through blockchain bridges, mixers and exchanges.
The financial figures associated with the attack distinguish the original theft, Binance's response and the government's recovery efforts.
M. Scott Proctor, principal deputy assistant attorney general for national security at the DOJ, said the government would continue pursuing cryptocurrency linked to North Korean operations.
"North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," Proctor said in a statement.
"Today’s announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime. The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains."
Binance separately announced that it had completed coverage of assets affected by the hack and published a new proof-of-reserves snapshot. The exchange's announcement followed its earlier commitment to use company funds to cover the losses.
FBI Disrupts FaceStealer Campaign Behind $400M in Crypto Theft
Federal agents also seized cloud infrastructure supporting FaceStealer, a separate North Korean hacking campaign that the FBI said had stolen more than $400 million in cryptocurrency over the past 18 months. The operation relied on compromised communication accounts, prerecorded webcam footage and increasingly sophisticated AI-generated deepfakes to deceive victims during video conferences.
Attackers used stolen accounts to invite targets into meetings resembling Zoom or Microsoft Teams calls. During those sessions, they impersonated familiar contacts using recordings or synthetic video footage. After establishing contact, the hackers claimed that a technical issue was preventing the meeting from functioning properly and instructed victims to install software or run commands presented as fixes.
Those instructions instead installed malware capable of stealing cryptocurrency and giving attackers access to other systems. According to the DOJ, some account takeovers and thefts occurred months to more than a year after the victim's computer had initially been compromised.
Patrick Grandy, assistant director in charge of the FBI's Los Angeles Field Office, warned that the operation exploited people's familiarity with video-conferencing tools and personal contacts.
"It exploits our trust in ubiquitous video conference platforms and valued personal relationships," Grandy said. "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."
The hackers also used stolen contacts and communication accounts to identify additional victims, including developers responsible for maintaining widely used open-source software. The FBI warned that compromising these developers could potentially allow attackers to reach other users through their software.
Federal authorities seized more than 900 webcam videos collected from FaceStealer victims. The FBI also issued guidance for affected individuals as part of its response to the campaign.
This article has been refined and enhanced by ChatGPT.
