DOJ wins court authority to seize $1.2 billion from Binance hack, disrupts North Korean schemes

Nov 12, 2026

The DOJ obtained court authority to seize or restrain over $1.2 billion in crypto stolen by North Korean hackers (TraderTraitor) in the October 2026 Binance hack, which totaled over $6 billion. As of November 3, 2026, $2.85 billion had been frozen. The DOJ also disrupted the FaceStealer deepfake scheme, attributed to APT38/BlueNoroff, which stole over $400 million over 18 months.

Binance hack DOJ seizure

▪The DOJ said that on approximately October 29, 2026, North Korean military members stole more than $6 billion worth of virtual assets from Binance
▪Binance covered $6.34 billion in losses from the Oct. 29 hack using company funds rather than by recovering the stolen coins
▪The DOJ obtained court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance
▪The recovery operation for the Oct. 29 Binance hack is being run by the FBI's Los Angeles Field Office, Cyber Division and Virtual Asset Unit, with the Secret Service and IRS Criminal Investigation

North Korean TraderTraitor operation

▪On October 31, 2026, the FBI, U.S. Secret Service, and IRS Criminal Investigation issued a Cyber Alert attributing Oct. 29 Binance theft to North Korea and urging virtual asset service providers to block transactions with addresses the actors are using
▪The FBI refers to the North Korean military hackers responsible for the Binance theft as TraderTraitor
▪Investigators observed stolen Binance assets being converted primarily into ether

Asset freezing mechanics

▪The $1.2 billion under DOJ court authority comes out of the roughly $2.85 billion Binance reported as frozen or intercepted and does not represent newly recovered money
▪Assistant Attorney General A. Tysen Duva said a combined U.S. government and private-sector freeze of more than $2.7 billion in stolen Binance assets halted approximately half of the October 2026 exchange heist
▪As of November 3, 2026, Binance reported approximately $2.85 billion in stolen assets had been frozen or intercepted
▪The DOJ's court authorization to seize or restrain more than $1.2 billion is the legal step that allows the government to move toward taking ownership of funds through forfeiture, where until that point the funds had simply been frozen at token issuers

FaceStealer deepfake scheme

▪FaceStealer meetings run on imposter versions of Zoom, Microsoft Teams, and Google Meet, with invitations distributed through hijacked Telegram, LinkedIn, Slack, or Discord accounts
▪Pursuant to a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims
▪The U.S. attorney's office in the Central District of California and the FBI seized cloud-based infrastructure used in FaceStealer, a North Korean social engineering campaign
▪North Korean hackers behind FaceStealer lure targets with meeting invitations sent from accounts stolen from earlier victims, then play a prerecorded or deepfake webcam video before sending malware disguised as a technical fix
▪The FBI posted a hub for the FaceStealer campaign at fbi.gov/facestealer

North Korea crypto funding

▪North Korea's government uses cryptocurrency theft to fund its regime and illicit weapons program, according to Principal Deputy Assistant Attorney General for National Security M. Scott Proctor
▪In several FaceStealer cases, cryptocurrency theft came months to more than a year after the initial compromise, as hackers waited for wallet balances to grow
▪The FBI identifies the North Korean hackers behind FaceStealer publicly under names including APT38 and BlueNoroff