US Seizes $1.2 Billion of Binance Hack Crypto and Takes Down North Korea's $400 Million FaceStealer Deepfake Scheme

Published November 13, 2026, 3:55 AM PKT. Based on the US Justice Department announcement of November 12, 2026 (primary source), and reporting from CoinDesk, The Block and The Register the same day (secondary sources). Market data from Finnhub, November 13, 2026.

The US Justice Department said on November 12 that it has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, and that it has taken down the cloud infrastructure behind a North Korean deepfake scheme that has stolen more than $400 million in the last 18 months. The two actions are the biggest US law enforcement moves yet against the hackers behind the October 29 Binance theft, the largest crypto heist on record.

The department announced the actions as a coordinated strike against the North Korean government's schemes to fund its regime through crypto theft. "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," said M. Scott Proctor, the principal deputy assistant attorney general for national security. "Today's announcement shows that America will fight back against that corrupt regime's effort to profit through cybercrime."

The $1.2 billion court order

On or about October 29, members of the North Korean military, referred to by the FBI as TraderTraitor, stole more than $6 billion worth of virtual assets from Binance, the Justice Department said. Since the theft, the department's National Security Division, its Criminal Division and the US Attorney's Office for the District of Columbia have worked with virtual asset service providers to track the money down.

Collective US government and private sector efforts have now frozen more than $2.7 billion of the stolen funds, the department said, and it has already obtained court authorization to seize or restrain more than $1.2 billion of that amount. The two figures describe different stages of the same recovery, so they cannot be added together. The $1.2 billion is part of the $2.7 billion freeze, not an additional recovery, and a court order to seize or restrain assets is not a completed forfeiture. Forfeiture proceedings are still to come, and the department did not say when any of the money would be returned to Binance.

"The Criminal Division, specifically the Computer Crime and Intellectual Property Section, and our law enforcement partners played the critical role in immediately freezing billions of dollars' worth of stolen Binance digital assets before they got beyond law enforcement reach," said Assistant Attorney General A. Tysen Duva of the Justice Department's Criminal Division. Duva said the division "quickly and efficiently used its expertise to immediately halt about half of this historic breach."

"The North Korean regime may think they are sophisticated cyber criminals, but we have consistently met them head on, as we did here seizing more than $1.2 billion of their stolen assets," said US Attorney Jeanine Ferris Pirro for the District of Columbia.

How FaceStealer stole $400 million with fake video calls

Separately, the US Attorney's Office for the Central District of California announced the disruption of cloud-based infrastructure used by North Korean hackers in a social engineering scheme the FBI calls FaceStealer. The scheme, which relies on surreptitiously recorded videos and artificial intelligence deepfakes, has resulted in the theft of more than $400 million in the last 18 months, according to the Justice Department, and it has also been used to try to compromise people who build and maintain open-source software.

The hackers, tracked publicly as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima, lure targets with invitations to video meetings sent from accounts stolen from earlier victims. Once a target joins the meeting, the hackers record the target's webcam video and play a prerecorded video of a previous victim, or of someone the target trusts, to simulate the participation of a trusted contact. The department said the hackers also use what it calls super intelligence to create deepfake videos of well-known and influential people in the crypto and Web3 industries, and use those videos in the meetings to gain the target's trust.

During the meeting, the hackers introduce a fake technical error, such as claiming that the target cannot be heard, and provide a link or a prompt to fix it. The fix secretly installs malware on the target's computer. With the computer compromised, the hackers can steal cryptocurrency or exploit the target's access to other computer infrastructure. In several reported cases, the hackers stole cryptocurrency and hijacked communication accounts several months to more than a year after the initial compromise, and they used the victim's contact lists, social media and messaging apps to target the victim's personal and professional contacts.

"North Korea's FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user," said Patrick Grandy, the assistant director in charge of the FBI's Los Angeles Field Office. "It exploits our trust in ubiquitous video conference platforms and valued personal relationships."

FBI Cyber Branch Operations Director Brett Leatherman said North Korean actors have used the scheme to aggressively target people in the crypto and Web3 sectors, "resulting in the theft of more than $400 million in the last 18 months."

The 900 videos the FBI took back

Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims, the Justice Department said. The videos are the raw material of the scheme: recordings of real people, harvested in fake meetings and replayed to impersonate them in later ones.

The FBI published a report on November 12 with greater detail on how the scheme works, including best practices to protect against it and steps victims can take after a compromise. The bureau also created a central resource hub at fbi.gov/facestealer. The effort to disrupt the campaign was led by Assistant US Attorney Khaldoun Shobaki for the Central District of California and the FBI's Los Angeles Field Office.

"Cryptocurrency unfortunately has become fertile ground for North Korea to defraud victims and fund its malign activities," said First Assistant US Attorney Bill Essayli for the Central District of California. "Today's seizure shows that America will continue the fight against rogue states who financially gain from cybercrime."

The laundering is still going

The court orders do not end the Binance recovery effort. The Justice Department said efforts to trace, freeze, seize and forfeit the stolen assets are ongoing, as TraderTraitor actors continue to launder the money through bridges, mixers and exchanges. Last week, the FBI, working with the US Secret Service and the Internal Revenue Service's criminal investigation division, issued a cyber alert attributing the theft and urging virtual asset service providers to block transactions with addresses TraderTraitor is using to launder the stolen funds. The FBI's October 31 alert listed Ethereum ($ETH) addresses tied to the operation.

The FBI's Los Angeles Field Office, its Cyber Division and its Virtual Asset Unit are coordinating the recovery effort, working with the Secret Service and the IRS criminal investigation division.

Binance already covered the losses from its own funds

The seizure action sits alongside Binance's own response to the hack. Earlier on November 12, Binance said it had finished covering the affected customer balances using its own resources, The Block reported, after committing more than $6.34 billion from its SAFU emergency reserve, its futures insurance fund and its corporate treasury. The exchange also published a new proof of reserves snapshot covering 198 tokens.

That means the money the Justice Department is now moving to seize is separate from the funds Binance used to make its users whole. The seized crypto is still stolen property, and its return to Binance will run through the US forfeiture process, not through the exchange's own recovery.

The market context

The announcement landed on a weak week for crypto markets. Bitcoin ($BTC) traded near $71,000 in the early hours of November 13, down about 3.7 percent on the day after falling below $72,000 overnight, according to Finnhub data. US spot Bitcoin ($BTC) exchange-traded funds have now recorded five straight days of outflows, and the Crypto Fear and Greed Index stood at 28, in Fear territory, on November 12.

What to watch next

The next facts to watch are whether the Justice Department files forfeiture cases for the $1.2 billion under court orders and how much of it is ultimately returned to Binance, whether the FaceStealer infrastructure seizure leads to charges or further takedowns, whether the FBI publishes more TraderTraitor wallet addresses for exchanges to block, whether Binance confirms the reopening of withdrawals for the six tokens still restricted after the hack, and whether the October producer price index, due November 13, moves the market before the Federal Reserve's December 9 decision.

Sources

• US Justice Department, Justice Department Announces Actions to Disrupt North Korea's Massive Theft of Cryptocurrency, November 12, 2026 (primary source: court-authorized seizure and restraint of more than $1.2 billion in cryptocurrency stolen from Binance; collective US government and private sector efforts have frozen more than $2.7 billion; the October 29 theft of more than $6 billion is attributed to North Korean military hackers known as TraderTraitor; the FaceStealer scheme has stolen more than $400 million in the last 18 months; the FBI seized more than 900 webcam videos of victims under a federal warrant; the FBI published a report on the scheme and created a resource hub at fbi.gov/facestealer)
• CoinDesk, DOJ gets court approval to seize $1.2 billion tied to North Korea's Binance hack, November 12, 2026 (secondary source: the Justice Department received court authority to seize more than $1.2 billion frozen after the theft at Binance; the authorized seizure is part of a broader effort that has frozen more than $2.7 billion of the more than $6 billion stolen from Binance on October 29)
• The Block, DOJ moves to seize $1.2 billion from Binance hack, disrupts North Korean deepfake scheme, November 12, 2026 (secondary source: the Justice Department obtained court approval to seize or restrain more than $1.2 billion stolen from Binance and disrupted a separate North Korean scheme that used fake video calls to steal crypto; Binance previously put its losses at about $6.3 billion and set aside $6.34 billion to cover them; earlier on November 12, Binance said it has completed coverage of assets impacted in the hack and published a new proof of reserves snapshot)
• The Register, DOJ takes aim at $1.2B in Binance loot as FBI disrupts North Korean scam, November 12, 2026 (secondary source: the US government said it had obtained court authorization to seize or restrain more than $1.2 billion stolen during the $6.3 billion Binance heist; the FBI seized more than 900 webcam videos belonging to FaceStealer victims; FaceStealer is tied to more than $400 million in theft over 18 months)

This article is news reporting and is not investment advice.