U.S. Justice Department Moves to Seize $1.2 Billion Stolen From Binance and Disrupts North Korea's FaceStealer Scheme

The U.S. Department of Justice said on 12 November 2026 that it has obtained court authorisation to seize or restrain more than $1.2 billion worth of cryptocurrency stolen from Binance in the 29 October hack, which the FBI attributes to North Korean military hackers it calls "TraderTraitor". In the same announcement the Department said it had seized cloud-based infrastructure used in a separate North Korean social engineering scheme, "FaceStealer", that the FBI says has taken more than $400 million in cryptocurrency over the last 18 months.

According to the Department, combined U.S. government and private-sector efforts have so far frozen more than $2.7 billion of the more than $6 billion in virtual assets taken from Binance. The $1.2 billion covered by court authorisation is part of that frozen amount. The release was issued by the Office of Public Affairs as press release number 26-1356, with the National Security Division, the Criminal Division's Computer Crime and Intellectual Property Section (CCIPS), the FBI and the U.S. Attorney's Offices for the District of Columbia and the Central District of California named as participating components.

How the Binance Funds Were Frozen and What Happens Next

The Justice Department says the theft took place on or about 29 October 2026 and involved more than $6 billion worth of virtual assets. Since then, the National Security Division's National Security Cyber Section, CCIPS, the U.S. Attorney's Office for the District of Columbia and law enforcement partners have worked closely with virtual asset service providers (VASPs) to interdict the stolen assets. Assistant Attorney General A. Tysen Duva of the Criminal Division said CCIPS and its partners froze "billions of dollars' worth" of the stolen assets before they moved beyond the reach of law enforcement, halting "about half" of the breach.

The release makes clear that the process is not finished. It says efforts to trace, freeze, seize and forfeit the stolen assets are ongoing, because TraderTraitor actors continue to launder the proceeds through cryptocurrency bridges, mixers and exchanges. The FBI's Los Angeles Field Office, Cyber Division and Virtual Asset Unit are coordinating the recovery work with the U.S. Secret Service and IRS Criminal Investigation. A court-authorised seizure or restraint is not the same as a final forfeiture: the release does not say when, or to whom, recovered assets would ultimately be returned.

For exchanges, custodians and other VASPs, the practical point is the request already made to them. The Department says that in the week before the announcement the FBI, together with the Secret Service and IRS-CI, issued a Cyber Alert attributing the Binance theft and urging VASPs to block transactions with, or derived from, cryptocurrency addresses that TraderTraitor actors are using to launder the stolen assets. Firms that screen deposits and withdrawals against those addresses are part of the same interdiction effort that produced the $2.7 billion freeze.

The FaceStealer Seizure and the FBI's Warning to the Crypto Industry

The second part of the announcement came from the U.S. Attorney's Office for the Central District of California, which said it had disrupted cloud-based infrastructure behind FaceStealer. The Department links the scheme to North Korean state hackers publicly known as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. Pursuant to a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims.

The FBI's FLASH alert of 12 November 2026 (AC-111226-MS), published on the IC3 website, describes how the scheme works. Targets receive meeting invitations from genuine Telegram, LinkedIn, Slack or Discord accounts hijacked from earlier victims, are sent links to typo-squatted domains imitating Zoom or Microsoft Teams, and join a fake call in which pre-recorded webcam footage of the earlier victim, and in some cases deepfake videos of well-known industry figures, is played. A staged technical error then leads the target to run a "fix" that installs malware. The FBI says the hackers sometimes waited months, or more than a year, before draining wallets, and that they have increasingly targeted open-source software maintainers, which the Department says appears calculated to enable software supply-chain attacks.

The alert is addressed to the cryptocurrency and web3 industry and to open-source maintainers, and sets out recommendations for preventing and responding to a compromise. The FBI has also created a resource page at fbi.gov/facestealer. Neither the release nor the alert names individual victims beyond Binance, and neither announces charges against named individuals.

Why It Matters Beyond the United States

Binance's global platform has been supervised since January 2026 by the Financial Services Regulatory Authority of Abu Dhabi Global Market, which said on 30 October that it was engaging closely with Binance and monitoring the incident. The U.S. action is the first official statement from a law enforcement authority quantifying how much of the stolen amount has been frozen and how much is now covered by court orders. For compliance teams at licensed exchanges in any jurisdiction, the announcement is a reminder that freezing requests and address lists linked to the theft are still circulating, and that laundering of the remaining assets is continuing through bridges, mixers and exchanges.