 |
| AI-generated illustration of a digital vault of blockchain cubes cracking open, golden cryptocurrency coins flowing toward a glowing justice shield, with a shadowy video call on a laptop behind it. |
On Thursday, November 12, 2026, the U.S. Department of Justice announced it had won court approval to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, the world's largest crypto exchange, in a theft the FBI blames on North Korean military hackers. The announcement, published as DOJ press release 26-1356, is the first large recovery in the October 29 heist, in which more than $6 billion in digital assets vanished from Binance in about 20 minutes — the largest cryptocurrency theft on record. In the same announcement, the FBI said it had seized the cloud servers behind FaceStealer, a separate North Korean social-engineering campaign that used fake video calls and secretly recorded webcam footage to steal more than $400 million over 18 months. Two points need to be kept straight from the start. The $1.2 billion is not new money on top of the $2.7 billion that U.S. authorities and private companies have already frozen; it is the part of that frozen pool a court has now authorised the government to seize or restrain, and it is not the same as money returned to Binance or its users. And the attribution to North Korea is the FBI's: Pyongyang denies any involvement, and President Donald Trump said on October 31 that the matter was still under investigation and that North Korea's role could not yet be definitively confirmed. This article explains what the Justice Department actually announced, how the heist and the FaceStealer trap worked, and what it means for anyone who holds crypto.
The scale is what makes this story different from an ordinary exchange hack. At about $6.3 billion, the Binance theft is more than four times the $1.5 billion stolen from Bybit in February 2025, the previous record, and the FBI says the same North Korean cluster was linked to that attack too. The money was taken fast — reporting puts the theft at about 20 minutes starting at 4:30 p.m. Eastern on October 29 — and the recovery has been a race against the clock ever since, with the stolen funds moving through blockchain bridges, mixers and exchanges while investigators tried to freeze them before they disappeared beyond reach. Tether, the company behind the USDT stablecoin, froze more than $1.5 billion within 30 minutes of the incident. Binance, for its part, says it has already covered the losses from its own funds, committing more than $6.34 billion to replenish affected customer assets and publishing a new proof-of-reserves snapshot on November 12. The DOJ announcement matters for two reasons: it is the first time a court has put a large slice of the stolen money under the government's legal control, and the FaceStealer takedown exposes a scam that is still aimed at ordinary crypto holders, not just exchanges.
As an Amazon Associate, we earn from qualifying purchases.
Prices and savings can change. Check the retailer for the current price.
What the Justice Department actually announced
The announcement, issued on November 12, covers two coordinated actions against what the department describes as North Korea's schemes to fund its government through the massive theft of cryptocurrency. The first is the court-authorized seizure and restraint of more than $1.2 billion in crypto stolen from Binance. The second is the seizure of cloud-based infrastructure used in FaceStealer, run as a separate case by the U.S. Attorney's Office for the Central District of California with the FBI's Los Angeles Field Office. The Binance recovery was coordinated by the National Security Division's National Security Cyber Section, the Criminal Division's Computer Crime and Intellectual Property Section, and the U.S. Attorney's Office for the District of Columbia, with the FBI's Los Angeles Field Office, its Cyber Division and its Virtual Asset Unit leading the recovery alongside the Secret Service and IRS Criminal Investigation. The words in the release matter. "Seize or restrain" is not the same as "recovered and returned": to seize is to take custody of the coins, to restrain is to lock them in place so nobody can move them without the court's say, and forfeiture proceedings — the legal process that decides who ultimately gets the money — are still ongoing. The release does not name the court, the judge or the type of order, does not say which coins make up the $1.2 billion, and does not say how much was seized as opposed to restrained. The department's language about why it acted was blunt. "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," said M. Scott Proctor, principal deputy assistant attorney general for national security. "Today's announcement shows that America will fight back against that corrupt regime's effort to profit through cybercrime." Assistant Attorney General A. Tysen Duva, of the Criminal Division, said its computer-crime section "played the critical role in immediately freezing billions of dollars' worth of stolen Binance digital assets before they got beyond law enforcement reach." That framing — a state funding itself through theft — is why this is treated as a national-security case, not just a very large robbery.
The October 29 heist: $6.3 billion in about 20 minutes
What is publicly known about the heist itself is still thin, and the gaps are worth stating plainly. On or about October 29, a group the FBI calls TraderTraitor stole more than $6 billion in virtual assets from Binance; Binance puts its own loss at about $6.3 billion. The FBI's cyber alert on October 31 attributed the theft to TraderTraitor, described as a North Korean military-linked hacking operation, and the same cluster was linked by the FBI and private industry to the $1.5 billion Bybit heist last year. Reporting on the incident puts the theft at about 20 minutes, starting at 4:30 p.m. Eastern. What has not been disclosed is how the attackers got in: the Justice Department's announcement does not describe the technical method of the Binance breach, and no court filing about the seizure had been made public as of November 13. It is also not clear whether FaceStealer played any part in the Binance breach at all — an FBI agent told The Record that was unclear, and the department presents the two operations as separate. The attribution itself is contested. North Korea denies any part in the theft, and President Trump said on October 31 that the matter was still under investigation and that it was not yet possible to definitively confirm North Korea's involvement. The honest position, and the one the evidence supports, is that the FBI has attributed the heist to a North Korean military unit, the U.S. government is acting on that attribution, and the attribution has not been independently proven in public. What is not in doubt is the size: at about $6.3 billion, this is the largest cryptocurrency theft ever recorded, more than four times the previous record, and the speed of it — tens of millions of dollars a minute — is what forced the recovery effort to move at the same pace.
FaceStealer: the fake video call that steals your crypto
FaceStealer is the part of this story that can reach anyone, and it is worth understanding in detail because the trap is designed to defeat exactly the instincts people rely on. According to the FBI, the scheme works in stages. First, the hackers compromise a real person's social media and messaging accounts, so the invitation that arrives comes from a contact the victim genuinely knows and has interacted with before. Second, that contact invites the victim to a video meeting on an imposter version of familiar software — fake pages imitating Zoom, Microsoft Teams or Google Meet. Third, once the victim joins, they are secretly recorded, and the call hits a mock technical problem: an "audio error" or similar glitch that supposedly needs a fix. Fourth, the victim is told to click a link, install software or run a command to fix it — and that is the malware, which can steal cryptocurrency and give the attackers access to the victim's computer and accounts. Fifth, the victim's own contacts are harvested and become the next round of targets, with the secretly recorded webcam footage reused to impersonate them. The FBI says the scheme has stolen more than $400 million in cryptocurrency over the past 18 months, and that the hackers are increasingly using artificial intelligence to create deepfake videos of well-known and influential people in the cryptocurrency industry. In Thursday's action the FBI seized the cloud infrastructure behind the scheme, including a library of more than 900 secretly recorded webcam videos of victims. The bureau also warned that the attackers have targeted developers who maintain widely used open-source software, because compromising one developer can open a path into the software many others rely on. The FBI has published a detailed report on the mechanics of the scheme, with best practices and steps victims can take, and has set up a central resource hub at fbi.gov/facestealer. The bureau attributes FaceStealer to a cluster of North Korean hackers known as Sapphire Sleet, also tracked as UNC1069, with aliases including BlueNoroff, APT38, Stardust Chollima, Dangerous Password and CryptoCore — a separate group from TraderTraitor, the cluster blamed for the Binance heist.
How $2.7 billion got frozen before it vanished
The recovery numbers look confusing until the three figures are separated, so here they are in plain terms. The theft was about $6.3 billion. U.S. government agencies and private-sector partners have together frozen more than $2.7 billion of it. The $1.2 billion under Thursday's court authorization is part of that $2.7 billion, not money on top of it — roughly one dollar in five of what was stolen, now under a court's control. The reason any of it could be frozen at all is that cryptocurrency theft, for all its reputation for anonymity, leaves a trail: blockchains are public ledgers, and stolen funds have to move through bridges, mixers and exchanges to become spendable, which is where investigators and companies can intercept them. The fastest freeze came from Tether, which reported freezing more than $1.5 billion in USDT within 30 minutes of the October 29 incident. Exchanges, stablecoin issuers and blockchain-analytics firms then worked with the FBI, the Secret Service and the IRS to trace and freeze more, and the Justice Department says investigators are still tracing stolen cryptocurrency moving through bridges, mixers and exchanges to freeze and recover more of the funds. The limits of that approach are also clear. Freezing is not recovering: frozen coins still have to go through forfeiture proceedings, and the department has not said who will ultimately receive the money or when. And a large share of the stolen funds has not been frozen at all, which is why the tracing work continues. The practical lesson is that the crypto industry's much-criticised central points of control — the exchanges and the stablecoin issuers — are also the reason a fifth of the largest heist in history could be clawed back within two weeks.
What Binance did for its users
For Binance's own customers, the most important development this week did not come from the Justice Department at all. Binance said on November 12 that it has completed the replenishment of customer assets affected by the October 29 breach, committing more than $6.34 billion in company funds to cover the losses, and that it has published a new proof-of-reserves snapshot taken at 00:00 UTC on November 12. The company estimated that generating the complete proof would take another 40 to 50 hours because of the computational load, so the snapshot is published while the full proof is still being produced and users cannot yet independently verify the one-to-one backing for the newly covered assets. Two things follow from that. First, Binance customers were not waiting on the DOJ seizure to be made whole — the exchange covered the loss from its own balance sheet, which is why the $1.2 billion court authorization is about the stolen funds and the eventual forfeiture, not about reimbursing users. Second, the episode is a reminder of how much of crypto's safety net depends on the solvency and good faith of a single company: a $6.3 billion hole was covered because Binance could afford to cover it, and the proof that it did is still being computed. None of that diminishes the DOJ announcement, but it sets its scale correctly. The seizure is a law-enforcement milestone in the biggest crypto theft on record, and it is separate from the question of whether any individual user lost money, which Binance says it has already resolved.
How to protect yourself from FaceStealer-style scams
- Treat any unexpected video-meeting invite as suspicious, even when it comes from a contact you know — verify it through a second channel, such as a phone call or a different messaging app, before joining.
- Never install software, run a command, or click a "fix" link during a video call, especially after an "audio error" or technical problem appears out of nowhere.
- Check the meeting link carefully: FaceStealer uses imposter pages that imitate Zoom, Microsoft Teams, and Google Meet, and a slightly wrong address is the giveaway.
- Remember you may be recorded: if a call feels wrong, leave immediately, warn the contact whose account invited you, and assume any footage of you could be reused to target your contacts.
- Keep most of your crypto in a hardware wallet and offline; never type a seed phrase or approve a transaction because someone on a video call told you to.
- If you build or maintain open-source software, treat unexpected meeting invites with extra care — developers are a deliberate target, because one compromised developer can reach many users.
- If you think you were targeted, follow the FBI's guidance at fbi.gov/facestealer and report the incident rather than trying to fix it quietly.
Bottom line
The Justice Department's November 12 announcement is a genuine milestone — the first court-backed recovery of a large slice of the biggest cryptocurrency theft in history — but it is a milestone, not a resolution. About one dollar in five of the stolen money is now under court authorization, forfeiture proceedings are still ongoing, the department has not said who will ultimately receive the money or when, and a large share of the stolen funds is still being traced through bridges, mixers and exchanges. The attribution to North Korea is the FBI's and is denied by Pyongyang, so it should be reported as an attribution, not as a proven fact. The part of this story with the longest consequences may not be the billion-dollar figures at all, but FaceStealer: a cheap, repeatable trap — a trusted contact, a fake meeting, a fake error, a malicious link — that stole more than $400 million before the FBI seized its servers, and whose playbook of recorded video and AI deepfakes will be copied. For anyone holding crypto, the practical lesson is the checklist above, not the headlines. Verify the invite, never install the fix, and keep your keys offline.
Reference sources
- U.S. Department of Justice: Justice Department Announces Actions to Disrupt North Korea's Massive Theft of Cryptocurrency
- Reuters: North Korean hackers steal more than $400 million using video images, FBI says
- CoinDesk: DOJ gets court approval to seize $1.2 billion tied to North Korea's Binance hack
- Associated Press: FBI says US has seized $1.2 billion worth of cryptocurrency stolen from Binance
- Sky News: FBI seizes $1.2bn stolen in Binance cryptocurrency hack
- New York Post: FBI reveals cunning ruse North Korean hackers used in massive crypto heist as feds claw back $1.2B
- FBI: FaceStealer resource hub
Leave a public comment