DOJ Freezes $1.2 Billion in Crypto Tied to Binance Hack

The U.S. Department of Justice seized and froze more than $1.2 billion in cryptocurrency linked to a Binance hack, which the department attributed to North Korean hackers. The operation also covered infrastructure associated with FaceStealer, a social engineering scheme linked to more than $400 million in theft.

According to the DOJ account, the Binance theft occurred last month. The disclosure gives no calendar date, transaction hashes, wallet addresses or case number, leaving the timing and specific on-chain path of the seized assets unidentified. It also does not describe the $1.2 billion as a final victim-restitution award.

What does the enforcement action cover?

The action has two components. First, the DOJ froze cryptocurrency identified as linked to the Binance hack. Second, it seized infrastructure associated with FaceStealer, a social engineering scheme linked to more than $400 million in theft.

The figures should not be added together. The $1.2 billion applies to crypto linked to the Binance hack, while $400 million describes theft linked to FaceStealer; the DOJ account does not say whether the two amounts overlap. The department presents one operation with asset seizure and infrastructure seizure components.

How large is the enforcement action?

The $1.2 billion Binance-linked seizure is more than three times the $400 million linked to FaceStealer. That comparison indicates the relative scale of the two figures without establishing a combined loss or recovery total.

The DOJ described the operation as a major federal enforcement action involving a large amount of stolen digital assets. Its attribution to North Korean hackers also places the case within the department's stated remit of combating cybercrime, protecting financial systems from illicit activity and addressing threats with national security implications.

What does this mean for exchange security?

The action adds scrutiny to security at major crypto exchanges. The DOJ account calls Binance one of the world's largest cryptocurrency exchanges and says it facilitates a wide range of digital asset transactions; the seizure covers both crypto linked to the hack and infrastructure associated with FaceStealer.

The DOJ account does not identify a specific Binance security failure, affected customer accounts or reimbursement arrangements. It instead frames the action within broader concerns about cybercrime risks at crypto platforms and vulnerabilities at major exchanges.

The legal effect is control over the assets and associated systems, not a stated final resolution. Seizure and freezing put the recovered crypto under federal control, while the broader action reflects concerns about rising cybercrime in crypto and vulnerabilities at major exchanges.

What remains unresolved?

The account names the DOJ, Binance and FaceStealer but does not identify the individual hackers, the wallets holding the assets, the jurisdictions involved or the number of victims. It also provides no valuation methodology for the seized crypto and no breakdown between the Binance-linked assets and FaceStealer infrastructure.

No forfeiture date, prosecution timetable or victim distribution schedule appears in the account. The assets are frozen, but their disposition and the process for resolving claims remain unspecified. The next milestone is a court docket or DOJ update identifying the assets, legal process and distribution; without a deadline, the enforcement window from seizure through court resolution remains open.