Crypto Hack: DOJ Seeks to Seize $1.2B Stolen from Binance - Cointribune
The US Department of Justice has obtained a court order to seize or freeze over $1.2 billion from the Binance hack, while also neutralizing FaceStealer, a deepfake campaign responsible for $400 million in crypto theft.
On November 12, 2026, the United States Department of Justice announced two major operations against North Korean networks involved in cryptocurrency theft. Authorities obtained a court order to seize or freeze more than $1.2 billion from the Binance hack that occurred on October 29, 2026. Separately, they neutralized the cloud infrastructure of FaceStealer, a deepfake manipulation campaign responsible for over $400 million in crypto theft over 18 months.
According to the official Department of Justice statement, more than $2.7 billion has been frozen from loot estimated at more than $6 billion across various crypto theft cases. The FBI attributes the Binance hack specifically to members of the North Korean army known as TraderTraitor.
Binance Hack Recovery
The court order covering $1.2 billion does not mean this sum has been definitively recovered. Freezing assets, seizing them, and possible confiscation are separate steps in the legal process. Investigators continue to trace the crypto funds as those behind the Binance hack attempt to launder the assets through various methods.
The hackers are using cryptocurrency bridges, mixing services, and various exchange platforms to launder the stolen funds. They even managed to launder $430,000 using memecoins created on the NEAR protocol. Binance has stated it has mobilized more than $6.34 billion in resources to cover the affected assets, though this financial coverage should not be confused with the judicial recovery of stolen funds.
FaceStealer Deepfake Campaign
The second U.S. operation targeted the cloud infrastructure used by FaceStealer, a North Korean campaign that caused more than $400 million in crypto thefts over the last 18 months. The operation relies on sophisticated social engineering techniques that exploit video conferencing platforms.
Hackers first use compromised accounts to invite their victims to videoconferences. They then discreetly record their webcam and broadcast prerecorded videos or deepfakes of people known to their interlocutors.
Once trust is established, hackers simulate a technical problem and offer a link or manipulation supposed to restore the meeting's function. In reality, this purported solution installs malware on the victim's computer, allowing hackers to steal crypto assets, hijack communication accounts, or exploit compromised computer access.
The campaign also specifically targets open-source software developers and maintainers, potentially to access their devices and code repository accounts to prepare attacks against the software supply chain. In this operation, the FBI seized over 900 webcam videos under a federal warrant and launched a dedicated FaceStealer information space.
Different Methods, Same Strategy
The Binance and FaceStealer cases represent different approaches to crypto theft but share a common strategy of exploiting the crypto ecosystem. The first concerns the massive diversion of assets from an exchange platform, while the second relies on manipulating victims through fake videoconferences and deepfakes.
These operations reveal the extent of threats targeting the crypto sector, where cybercriminals no longer only try to compromise wallets or platforms. They also exploit professional relationships, communication tools, and development environments to obtain sensitive access. The DOJ continues tracing, seizing, and confiscating assets from the Binance hack, while crypto actors are increasingly focusing on security beyond just digital wallet protection.
Related
