DOJ Wins Court Approval to Seize $1.2 Billion Stolen in North Korea's Binance Hack

The U.S. Department of Justice says it has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance in the October 29 hack that the FBI has tied to North Korea's military.

The announcement, made on Thursday, November 12, also revealed that U.S. agencies and private companies have now frozen more than $2.7 billion of the more than $6 billion taken from the exchange. Investigators say the hackers are still trying to launder the rest.

In the same release, the DOJ said the FBI had seized cloud infrastructure behind "FaceStealer," a North Korean deepfake video-call scheme that it says has stolen more than $400 million in crypto over the past 18 months.

What the DOJ announced

According to the department's statement, members of the North Korean military, tracked by the FBI as "TraderTraitor," stole more than $6 billion in virtual assets from Binance on or about October 29. We covered the first hours of the Binance hack when it broke.

Since then, the National Security Division, the Criminal Division's Computer Crime and Intellectual Property Section and the U.S. Attorney's Office for the District of Columbia have worked with exchanges and other virtual asset service providers to stop the funds from moving.

Those combined government and private-sector efforts have frozen more than $2.7 billion. Of that, the DOJ has already won court authorization to seize or restrain more than $1.2 billion. Bloomberg Law reported that the funds were frozen by Tether and Circle, the two biggest stablecoin issuers, right after the break-in.

Assistant Attorney General A. Tysen Duva said the Criminal Division and its partners were able to "immediately halt about half of this historic breach" by freezing stolen assets "before they got beyond law enforcement reach."

U.S. Attorney Jeanine Ferris Pirro for the District of Columbia put it more bluntly: "The North Korean regime may think they are sophisticated cyber criminals, but we have consistently met them head on, as we did here seizing more than $1.2 billion of their stolen assets."

A freeze is not the same as a recovery

The headline number needs some context. Bitcoin Magazine pointed out that the $1.2 billion is not newly recovered money. It comes out of the roughly $2.85 billion that Binance said on November 3 had been frozen or intercepted.

Until now those funds were simply frozen at the token issuers. The court authorization is the legal step that lets the government move toward taking ownership of them through forfeiture, and that process is not finished. The underlying court papers were not published with the announcement.

The DOJ also did not say how much of the frozen amount, or of the $1.2 billion now under court authority, is bitcoin.

Binance users were already made whole

For Binance customers, the seizure changes little day to day. The exchange has said it already covered the $6.34 billion in affected assets from its own money, Bitcoin Magazine reported, drawing on its Secure Asset Fund for Users (SAFU), part of its futures insurance fund and its treasury.

So the government's recovery effort and Binance's reimbursement run on separate tracks. The DOJ is chasing what the hackers took, while the exchange has already replaced the tokens. Binance's own account of how the attackers got in is in our report on the fake job interview and internal AI tool behind the breach.

The laundering trail is still live

The DOJ said TraderTraitor actors are still moving the stolen assets through cryptocurrency bridges, mixers and exchanges, and that work to trace, freeze, seize and forfeit them continues.

On October 31, the FBI, the Secret Service and IRS Criminal Investigation issued the Cyber Alert that pinned the hack on TraderTraitor and urged service providers to block transactions linked to the hackers' addresses. According to Bitcoin Magazine, the alert said the stolen funds had mainly been converted into ether.

The FBI's Los Angeles Field Office, Cyber Division and Virtual Asset Unit are leading the recovery work, alongside the Secret Service and IRS-CI.

FaceStealer: the deepfake meeting scam

The second half of Thursday's announcement may matter more to everyday people in crypto. The U.S. Attorney's Office for the Central District of California said it disrupted cloud infrastructure used in FaceStealer, a scheme run by North Korean groups publicly known as Sapphire Sleet, APT38, BlueNoroff and several other names.

The method is simple and effective. A target gets a meeting invite from an account stolen from an earlier victim. Once they join, the hackers record their webcam and play prerecorded footage of people they know, or AI-made deepfakes of well-known figures in crypto and Web3.

Then comes a fake technical problem, such as the target supposedly not being heard, along with a link or prompt to "fix" it. The fix quietly installs malware. In several cases, the DOJ said, the theft came months or even more than a year after the first compromise.

Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims. Bitcoin Magazine reported that the fake meetings ran on imposter versions of Zoom, Microsoft Teams and Google Meet, with invites often arriving through hijacked Telegram, LinkedIn, Slack or Discord accounts.

The group is also increasingly going after open-source software maintainers, which the DOJ said "appears calculated to enable software supply-chain attacks." The FBI has published a report with protection tips and a resource hub at fbi.gov/facestealer.

Why it matters

North Korea's crypto theft is a national security problem as much as a market one. "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," said M. Scott Proctor, principal deputy assistant attorney general for national security.

Freezing close to half of what the DOJ calls a historic breach shows how much stablecoin issuers and service providers can do when they move fast. It also shows the limits: more than half of the stolen funds are still out of reach, and the hackers keep moving them.

What comes next

The next step for the $1.2 billion is forfeiture, and the DOJ says tracing and seizure work on the rest is ongoing. Once court filings become public, they should show which tokens and wallets are involved.

For anyone working in crypto, the practical lesson sits in the FaceStealer details. An unexpected "audio fix" during a video call, even with a familiar face on screen, is now a documented North Korean attack pattern.