DOJ moves to seize $1.2B from Binance hack, disrupts FaceStealer scam

The US Department of Justice said Thursday it had obtained court authorization to seize or restrain more than $1.2 billion of the $6.3 billion in cryptocurrency stolen from Binance.

The authorization covers part of the more than $2.7 billion in stolen assets that US authorities and private-sector partners have frozen since the Oct. 29 hack. Investigators are still working to recover additional funds, the department said in its announcement.

The FBI attributed the Binance hack to North Korea’s TraderTraitor group in a cyber alert. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied North Korea’s involvement.

Binance said it had covered the affected assets with its own funds and that a new proof-of-reserves snapshot showed at least one-to-one backing for customer assets, according to its Thursday post on X.

In November 2025, the DOJ announced a separate enforcement action targeting about $15 million in cryptocurrency linked to North Korean hackers known as APT38.

Related: Crypto hack losses equal 57 cents per $1 earned onchain: Ark’s Valente

FBI warns of FaceStealer’s deepfake video calls

In a separate case, US authorities seized cloud infrastructure used in FaceStealer, a North Korean social engineering campaign that stole more than $400 million in cryptocurrency over the past 18 months, the DOJ said.