DOJ Seeks $1.2B Seizure From Binance Hack Amid FaceStealer Takedown

The U.S. Department of Justice said it has obtained court authorization to seize or otherwise restrain more than $1.2 billion in cryptocurrency tied to the $6.3 billion stolen from Binance in the Oct. 29 hack. The move covers a portion of the more than $2.7 billion in assets that U.S. authorities and private-sector partners have already frozen while they continue to pursue additional funds, the DOJ said in its announcement.

The alleged theft has been tied to North Korea by U.S. investigators. The FBI attributed the attack to the North Korean-linked TraderTraitor group, while Kim Yo Jong, sister of North Korean leader Kim Jong Un, denied the country’s involvement, according to reporting cited by Cointelegraph. Binance, for its part, said it covered affected assets with its own funds and pointed to a new proof-of-reserves snapshot showing at least one-to-one backing for customer assets in a post on X.

Key takeaways

• The DOJ secured court authority to seize or restrain over $1.2 billion connected to the Binance hack, as investigations continue into the remainder of frozen funds.
• U.S. investigators link the Binance theft to North Korea’s TraderTraitor, a claim North Korea denies.
• Binance says it covered affected assets and claims its latest proof-of-reserves snapshot shows one-to-one backing for customer assets.
• In a separate enforcement action, the DOJ described the FaceStealer deepfake scheme used to steal more than $400 million over roughly 18 months.

DOJ authorization targets a major slice of the Binance losses

According to the DOJ, the court authorization allows the government to seize or restrain more than $1.2 billion out of the larger pool of cryptocurrency stolen in the Binance incident. The DOJ framed the action as part of an ongoing effort that has already involved freezing more than $2.7 billion in stolen assets through cooperation between U.S. authorities and private-sector partners.

Investigators have not said they expect the full recovery in the near term. Instead, the department emphasized that recovery work continues for additional funds beyond the portion covered by the authorization.

Earlier, the DOJ also announced a separate enforcement action in November 2025 targeting about $15 million in cryptocurrency connected to North Korean hackers known as APT38. That history underscores a broader U.S. strategy of pursuing both the financial trail and the infrastructure used by state-linked cyber operators.

Attribution dispute: TraderTraitor vs. North Korea denial

At the center of the Binance case remains a long-running pattern in cyber attribution: U.S. agencies link major crypto thefts to North Korea, while Pyongyang denies involvement.

In a cyber alert, the FBI attributed the Binance hack to the North Korea-associated TraderTraitor group. Separately, Kim Yo Jong denied North Korea’s role in the theft, according to coverage referenced by Cointelegraph.

For market participants, attribution disputes matter less for day-to-day trading than for risk assessment and compliance. When investigators can tie a theft to a specific threat actor cluster, it can influence how exchanges, custodians, and investigators prioritize tracing, blocking, and monitoring tactics—especially when similar toolchains and laundering behaviors recur across incidents.

Binance says customer assets were covered

Binance said it addressed the impact of the stolen funds by covering affected assets with its own resources. In its Thursday statement on X, the exchange also pointed to a new proof-of-reserves snapshot, asserting that customer assets are backed at at least one-to-one.

That claim aims to directly address a recurring concern after major exchange hacks: whether customers remain fully protected if stolen assets are moved, mixed, or otherwise made inaccessible. While the DOJ’s action focuses on seizure and restraint of stolen crypto, Binance’s statements speak to internal coverage and reserve accounting.

Investors should also watch how proof-of-reserves disclosures and post-hack reserve management evolve over time, particularly as court actions proceed and any remaining frozen funds are either recovered, redistributed, or deemed unrecoverable.

New warning: FaceStealer uses deepfake video calls to engineer theft

Separate from the Binance-related matter, the DOJ described another campaign—FaceStealer—that it says relied on manipulation and modern AI techniques rather than a direct technical exploit.

U.S. authorities said they seized cloud infrastructure used in the scheme. The DOJ described FaceStealer as a North Korean social engineering effort that stole more than $400 million in cryptocurrency over the past 18 months.

Instead of traditional phishing alone, the DOJ alleged that attackers used secretly recorded footage of previous victims and AI-generated deepfakes of prominent crypto figures to build trust during video calls. The campaign then used purported “technical fixes” to induce targets to install malware, DOJ said.

According to the department, FaceStealer targeted people working in crypto and Web3. It also said the campaign increasingly went after open-source software developers and maintainers, attempting to access devices and accounts tied to software repositories.

Operationally, the FBI seized more than 900 webcam videos of victims under a federal warrant. The bureau also published guidance for the public on how to protect against the scheme and what to do after compromise, in a public advisory posted on the FBI’s Internet Crime Complaint Center (IC3) website.

The DOJ said the hackers behind FaceStealer have been known publicly by several names, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima.

Why these actions matter to crypto users and infrastructure builders

Taken together, the DOJ’s updates highlight two complementary threats facing the crypto ecosystem: state-linked attempts to steal and monetize funds, and increasingly sophisticated social engineering that can bypass technical defenses by impersonating trusted individuals.

For exchanges and custodians, seizure and restraint actions can help limit exposure by tightening the net around stolen assets—even after an attacker has already moved funds. For individuals and teams in the Web3 development stack, the FaceStealer allegations reinforce that identity and trust verification are now operational security issues, not just policy concerns. Deepfakes and recorded “proof” footage can make convincing interactions look legitimate, which is why incident response planning and stricter verification workflows become critical.

As U.S. authorities continue working through frozen holdings from the Binance hack and provide further details in the FaceStealer case, investors and builders should watch for next steps: whether additional court authorizations follow for other portions of seized assets, and how public advisories translate into practical safeguards for video-based outreach and account access.