DOJ Wins Court Order to Seize $1.2B of Binance Hack Proceeds

The US Department of Justice said Thursday it obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency tied to the October hack of Binance. The figure represents a portion of the $6.3 billion stolen from the exchange on Oct. 29, and part of over $2.7 billion that US authorities and private-sector partners have already frozen.

Investigators are still chasing the remainder. The DOJ said recovery efforts continue beyond the assets already restrained, and the announcement signals the enforcement window is open, not closing.

The FBI attributed the Binance hack to North Korea's TraderTraitor group in a cyber alert. Kim Yo Jong, sister of North Korean leader Kim Jong Un, denied the country's involvement. Attribution disputes aside, the money trail is doing the talking in federal court.

Binance moved quickly to shore up customer confidence. The exchange said it had covered the affected assets with its own funds, and a new proof-of-reserves snapshot showed at least one-to-one backing for customer assets, according to its Thursday post on X. That operational backstop matters: customers bore no direct loss, and the exchange absorbed the shortfall on its balance sheet.

This is not an isolated case. In November 2025, the DOJ announced a separate enforcement action targeting roughly $15 million in cryptocurrency linked to North Korean hackers known as APT38.

What is FaceStealer?

In a parallel action, US authorities seized the cloud infrastructure behind FaceStealer, a North Korean social engineering campaign that stole more than $400 million in cryptocurrency over the past 18 months, according to the DOJ.

The scheme was built on trust, then betrayed it. Hackers used secretly recorded footage of previous victims alongside AI-generated deepfakes of prominent crypto figures to win targets' confidence on video calls. Once trust was established, they offered bogus technical fixes that tricked targets into installing malware.

The campaign concentrated on people working in crypto and Web3. The DOJ said the hackers increasingly targeted open-source software developers and maintainers, attempting to compromise their devices and software repository accounts — a supply-chain risk that extends far beyond individual victims.

The FBI seized more than 900 webcam videos of FaceStealer victims under a federal warrant. The bureau also published a public advisory with guidance on protecting against the scheme and steps to take after a compromise.

The DOJ said the group operates under several public names, including:

• Sapphire Sleet
• UNC1069
• Dangerous Password
• CryptoCore
• APT38
• BlueNoroff
• Stardust Chollima

What does this change for the industry?

For exchanges, the seizure order confirms that hacked funds moving through any reachable jurisdiction remain vulnerable to US restraint — a meaningful deterrent even when perpetrators sit beyond prosecution. For developers and Web3 employees, FaceStealer's takedown makes one thing clear: video calls and unsolicited "technical support" are now primary attack surfaces.

What does this change for victims? Potentially a path to recovery. The $1.2 billion authorization, layered on the $2.7 billion already frozen, suggests a substantial share of the Binance haul could eventually return to its rightful owner — here, the exchange itself.

The FBI's advisory, paired with continued recovery efforts, sets the near-term agenda. Further seizure actions and additional frozen tranches appear likely as investigators work through the remaining stolen funds.