US moves to seize $1.2 billion of the Binance hack haul and shuts down North Korea's deepfake call trap
The Justice Department says it won court approval to seize or restrain more than $1.2 billion stolen from Binance on October 29. It also took down servers behind "FaceStealer," a fake video call scheme it ties to more than $400 million in thefts.
Key points
- The Justice Department says a court let it seize or restrain more than $1.2 billion in virtual assets stolen from Binance on October 29, 2026.
- US officials and private companies have frozen more than $2.7 billion of the haul. The department says the FBI calls the North Korean military unit behind the theft "TraderTraitor."
- The department also seized cloud servers behind "FaceStealer," a fake video call scheme it links to more than $400 million in crypto thefts over 18 months.
What the Justice Department announced
On Thursday, November 12, 2026, the US Justice Department announced two actions against North Korea's crypto theft. First, it obtained court authorization to seize or restrain more than $1.2 billion in virtual assets stolen from Binance. Second, it seized cloud-based servers used in a scheme it calls FaceStealer.
The release says members of the North Korean military, which the FBI tracks as "TraderTraitor," stole more than $6 billion from Binance on or about October 29, 2026. Binance's own count is about $6.34 billion. The FBI had already issued a Cyber Alert the week before, attributing the theft to North Korea and asking crypto companies to block transactions linked to the laundering addresses.
How much of the money is stuck
The department says US government and private-sector efforts together have frozen more than $2.7 billion of the stolen assets. The $1.2 billion covered by the court order is part of that frozen amount, not money on top of it. Seizing or restraining means the funds are locked under court control, which is a step toward returning them, not a refund yet.
A. Tysen Duva, the Assistant Attorney General for the Criminal Division, said his team moved to "immediately halt about half of this historic breach." The release does not list which tokens or how many addresses the order covers.
Binance hack: stolen vs. frozen vs. under US court order
US$ billion
Source: US Justice Department. All three figures are given as "more than."
FaceStealer: the fake video call
The second action targets a trick aimed at crypto and Web3 workers and open-source developers. According to the department, the attackers send a meeting invite from a hacked account of someone the target knows. On the call they record the target's webcam and play prerecorded clips or AI deepfakes of trusted contacts. Then they fake a "technical error" and ask the target to install a fix, which is malware.
The department ties FaceStealer to more than $400 million in crypto stolen over 18 months. Under a federal warrant, the FBI also seized more than 900 webcam videos of victims. The release names the groups tracked by security firms under names such as Sapphire Sleet, UNC1069, BlueNoroff, APT38 and Stardust Chollima. It warns that hacking developers could open the door to attacks on the software they ship.
Who is on the case
The release lists the National Security Division, the Criminal Division's computer crime section, the US Attorney's Offices for the Central District of California and the District of Columbia, the FBI's Los Angeles office, Cyber Division and Virtual Asset Unit, the Secret Service and IRS Criminal Investigation. It names no individual defendants and announces no charges. The Los Angeles prosecutors' copy of the release carries the same details.
LC Insight analysis
This section is our reading of the facts above, not a statement of fact.
- We think the $1.2 billion order is the clearest sign yet that a large part of the Binance haul will not reach North Korea's hands. Frozen is not returned, though: forfeiture cases can take months.
- FaceStealer is the same playbook Binance described for its own breach, a trusted-looking contact and a request to run something. In our view, any unexpected "install this fix" during a call should end the call.
- The department did not say how much of the $6 billion already left through mixers or bridges. That gap is the number to watch.
What's next
- A civil forfeiture complaint listing the exact tokens and addresses
- How much of the frozen $2.7 billion Binance gets back, and when
- New FBI alerts naming further laundering addresses
Disclaimer. This article is based on public information and the sources listed below as of the update time shown. It is for information only and is not investment, legal or tax advice. Figures may change as companies and authorities publish new data.
Sources
- US Justice Department, "Justice Department Announces Actions to Disrupt North Korea's Massive Theft of Cryptocurrency" (November 12, 2026)
- US Attorney's Office, Central District of California, same release (November 12, 2026)
- Binance on X, initial findings on the October 29 incident (November 3, 2026)
