DOJ Targets $1.2B in Binance Hack Funds and Disrupts North Korean FaceStealer Scam
The U.S. Department of Justice (DOJ) has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, marking a major step in efforts to recover funds from the October 2026 exchange hack.
The action covers part of the more than $2.7 billion in stolen assets that U.S. authorities and private-sector partners have frozen since the October 29 incident. Investigators are continuing efforts to trace and recover additional funds.
In a separate operation announced on November 12, the DOJ also disrupted cloud infrastructure used in FaceStealer, a North Korean-linked social engineering campaign that has stolen more than $400 million in cryptocurrency over the past 18 months.
DOJ Moves to Recover More Than $1.2 Billion From Binance Hack
The Binance attack involved more than $6.3 billion in stolen cryptocurrency. The FBI attributed the incident to North Korea's TraderTraitor group in an October 31 cyber alert, identifying the activity as part of the group's malicious operations.
Since the theft, U.S. agencies and private-sector partners have worked with virtual asset service providers to identify and freeze cryptocurrency connected to the attack. Their efforts have resulted in more than $2.7 billion in frozen assets, with the DOJ securing court authorization to seize or restrain over $1.2 billion of that amount.
The recovery process remains ongoing. Investigators are tracking funds as the attackers attempt to move them through cryptocurrency bridges, mixers and exchanges. The DOJ's November 12 announcement outlines the coordinated actions targeting the stolen assets and the separate FaceStealer operation.
FBI Attributes Binance Attack to North Korea's TraderTraitor
The FBI identified North Korea's TraderTraitor group as responsible for the Binance theft. In its October 31 cyber alert, the bureau said the stolen assets were being converted primarily into Ether (ETH), with further laundering expected through decentralized finance services and instant-swap platforms.
The FBI urged cryptocurrency exchanges, blockchain infrastructure operators, DeFi services, instant exchanges and other virtual asset businesses to block transactions involving addresses associated with the stolen funds. The alert also included cryptocurrency addresses linked to the activity to help industry participants identify and restrict suspicious transfers.
North Korea has rejected the accusation. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied the country's involvement and criticized the U.S. attribution as a political provocation. Her denial was carried in a statement published through North Korea's state-run media. The allegation and the denial remain competing positions; the FBI has publicly maintained its attribution.
Binance Says It Covered the Affected Assets
Binance said it had covered the assets affected by the security incident using company funds. On November 12, the exchange announced that it had committed more than $6.34 billion to cover the losses and source affected tokens through market purchases and over-the-counter channels.
The exchange said the funding came from several sources: a partial deployment of its Secure Asset Fund for Users (SAFU), funds from its Futures insurance fund above the level required by its risk-management framework, and its corporate treasury.
Binance also published a new Proof of Reserves snapshot dated November 12, covering 198 tokens. The exchange said the full zero-knowledge proof would take approximately 40 to 50 hours to generate. Once available, users holding affected tokens would be able to independently verify whether their assets were backed at a minimum one-to-one ratio. Binance also said withdrawals were reopening in phases and that it planned to replenish SAFU to approximately $1 billion. The details are available in its official security incident update.
DOJ Disrupts FaceStealer's $400 Million Crypto Theft Campaign
Alongside the Binance recovery operation, U.S. authorities seized cloud-based infrastructure used in FaceStealer, a social engineering campaign linked to North Korean hackers. The scheme has resulted in more than $400 million in cryptocurrency theft over the last 18 months.
The operation targeted people working in cryptocurrency and Web3, using deceptive video meetings to establish trust before delivering malware. Hackers used secretly recorded webcam footage from previous victims and AI-generated deepfake videos of prominent figures in the crypto industry to make their invitations appear legitimate.
During these meetings, attackers introduced fake technical problems, such as claiming that a participant's microphone was not working. They then directed the target to a supposed fix, which secretly installed malware on the victim's computer. Once a device was compromised, attackers could steal cryptocurrency and gain access to other systems and accounts.
Open-Source Developers Also Targeted
FaceStealer activity has expanded beyond cryptocurrency holders and Web3 professionals. Hackers have increasingly targeted open-source software developers and maintainers, attempting to compromise their devices and accounts used to manage software repositories.
Access to developer systems and repository accounts can create risks beyond the theft of individual funds. It may provide attackers with opportunities to interfere with software development and potentially compromise the broader software supply chain.
As part of the investigation, the FBI seized more than 900 webcam videos of FaceStealer victims under a federal warrant. Authorities also published guidance explaining how the scheme operates, how people can protect themselves and what steps victims should take after a suspected compromise.
The FBI's FaceStealer public advisory provides further details on the campaign and recommended security measures.
Multiple Names Linked to the FaceStealer Actors
The DOJ said the hackers behind FaceStealer are known by several names in cybersecurity investigations. These include Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.
The operation demonstrates two different approaches used in cryptocurrency-related cybercrime: large-scale exchange theft and targeted social engineering. The Binance case involves tracing and recovering billions of dollars in stolen digital assets, while FaceStealer relies on impersonation, deepfakes and malware to compromise individual victims and their systems.
U.S. authorities are continuing to pursue the stolen Binance funds while disrupting infrastructure used by the FaceStealer operators. Both investigations highlight the importance of cooperation between law enforcement agencies, cryptocurrency platforms and private-sector security teams in identifying suspicious activity and limiting further losses.
