US seizes $1.2 billion in crypto stolen from Binance, blames North Korea
The Justice Department said Thursday it has court approval to seize or restrain more than $1.2 billion of the crypto stolen from the Binance exchange on Oct. 29, a theft the FBI blames on North Korean military hackers. It also took down servers behind "FaceStealer," a fake video-call scam the FBI says stole more than $400 million.
AI-assisted · US Brief desk · Sources listed below
What happened
The Justice Department said Thursday it has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, one of the world's largest crypto exchanges. The FBI blames the Oct. 29 theft of more than $6 billion on North Korean military hackers it calls "TraderTraitor."
Why it matters
The department says North Korea's government funds its weapons program through crypto theft. The scam also targets people who maintain open-source software, which could let hackers slip bad code into programs many companies use. CyberScoop reported that one maintainer of a major JavaScript library was lured into a fake Teams meeting this year.
More context
How much is frozen: Joint efforts by U.S. agencies and private crypto firms have frozen more than $2.7 billion of the stolen assets, the department said. The $1.2 billion is the part the government now has court approval to control. Assistant Attorney General A. Tysen Duva said investigators halted "about half of this historic breach" before it moved out of reach. Tracing continues, because the hackers are still laundering funds through bridges, mixers and exchanges.
The second case: Separately, the FBI took down cloud servers used in a scheme it calls "FaceStealer." The department says North Korean hackers used it to steal more than $400 million in crypto over the past 18 months. Agents seized more than 900 webcam videos of victims under a federal warrant.
How FaceStealer works: Hackers send a video-meeting invite from an account stolen from someone the target knows. In the call, they play recorded video of past victims, or deepfakes of well-known crypto figures, to look trustworthy. Then they fake a glitch, such as "we can't hear you," and send a link or prompt to fix it. The "fix" installs malware that lets them steal crypto and take over the victim's accounts, sometimes months later.
What you can do: The FBI posted best practices and steps for victims at fbi.gov/facestealer. The warning sign, as the FBI describes the scheme, is a fake technical problem during a video call followed by a link or prompt to "fix" it.
What remains unknown: The department did not say whether or when Binance or its customers will get the restrained funds back. It also did not say where the rest of the stolen assets are, or whether anyone will be charged.
4 listed sources
- U.S. Department of Justice, Justice Department Announces Actions to Disrupt North Korea's Massive Theft of Cryptocurrency, Nov. 12, 2026
- CNBC (Jenni Reid), U.S. seizes $1.2 billion in cryptocurrency stolen from Binance, Nov. 13, 2026
- CyberScoop (Greg Otto), US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance, Nov. 12, 2026
- AP, FBI says US has seized $1.2 billion worth of cryptocurrency stolen from Binance, Nov. 12, 2026
References listed by US Brief; a source count is not a verification score.
Editorial sourcing notes
Dollar figures and the attribution to North Korea come from the Justice Department and FBI; they have not been tested in court. "Seize or restrain" means court-authorized control of the funds, not a final forfeiture or return to victims. Photos are file images of the Justice Department and FBI headquarters, not from this case.
Like US Brief? You can support it with a tip.