DOJ moves to seize $1.2B from Binance hack and disrupts FaceStealer scheme

The U.S. Department of Justice announced on Nov 12, 2026 that it had obtained court authorization to seize or restrain in excess of $1.2 billion in cryptocurrency tied to the Binance theft of Oct 29, and that federal agents separately seized infrastructure used in FaceStealer, a long-running North Korean social-engineering campaign that the FBI says has stolen more than $400 million over the last 18 months. Primary source: DOJ press release 26-1356 and the FBI IC3 advisory.

What DOJ announced

The press release groups two distinct operations under one North Korea crackdown:

• Binance seizure. DOJ says court orders cover "in excess of $1.2 billion" of the funds stolen in the Oct 29 Binance intrusion. The total loss is described as "more than $6 billion"; the combined law-enforcement and private-sector freeze now covers "more than $2.7 billion." The U.S. Attorney's Office for the District of Columbia is named on the Binance interdiction effort.
• FaceStealer. The U.S. Attorney's Office for the Central District of California seized cloud infrastructure that the FBI says the campaign used to steal $400M+ in crypto across 18 months, and separately seized over 900 webcam recordings the attackers collected from victims under a federal warrant.

The FBI attributes the Binance theft to TraderTraitor, which it describes as a group within the North Korean military. The FaceStealer actors are tracked by the industry under several aliases — Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima. DOJ does not merge the two operations: the $400M FaceStealer figure is separate from the $6B+ Binance loss.

How FaceStealer works

Per the FBI advisory and DOJ's description, the scheme lures crypto industry targets into video meetings run from compromised accounts of prior victims. Operators play prerecorded webcam footage of trusted contacts — colleagues, investors, open-source maintainers — and splice in AI deepfakes of well-known figures to maintain the fiction. After rapport is built, the operator stages a fake technical problem ("we can't hear you") and sends a "fix" link that installs malware. The payload can drain wallets directly or sit dormant for months before pivoting to other systems. The 900+ webcam recordings the FBI seized were collected from victims whose video feeds the operators captured during these calls.

The listed targeting surface is broad: individuals in the cryptocurrency and web3 industries and maintainers of open-source software. DOJ did not name any FaceStealer victim.

Who said what

• M. Scott Proctor, Principal Deputy Assistant Attorney General for National Security: "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft."
• Also quoted in the DOJ release: A. Tysen Duva (AAG, Criminal Division), Jeanine Ferris Pirro (U.S. Attorney, D.C.), Bill Essayli (First Assistant U.S. Attorney, C.D. Cal.), Brett Leatherman (FBI Cyber Branch), and Patrick Grandy (FBI Los Angeles ADIC).

Numbers

• Binance theft, total: more than $6B (Oct 29, 2026)
• DOJ seizure authority, Binance: $1.2B+
• Total frozen across government and private sector, Binance: $2.7B+
• FaceStealer total stolen, 18-month window: $400M+
• Webcam recordings seized: 900+
• Source: justice.gov

The DOJ release does not list wallet addresses, transaction hashes, or coin types.

What to watch

1. Court filings. DOJ references a court authorization for the Binance seizure but has not posted the filing on the release page. Watch PACER for the D.C. docket.
2. Recovery rate. $2.7B of $6B+ is roughly 45% frozen. The exploiter has moved funds through multiple bridges and swap routes since Oct 29; the gap between frozen and ultimately returned will depend on how much is still liquid on exchanges versus bridged to non-cooperating venues.
3. Attribution precision. DOJ names TraderTraitor and lists FaceStealer aliases but does not merge them. Later filings may tie specific wallets to one group or the other — a materially different attribution picture than lumping all DPRK crypto theft under "Lazarus."

Context

Blockchain Posts has tracked the Binance intrusion since the hack hit on Oct 29: the initial $6.3B drain, the SAFU fund drawdown, the Elliptic $3.1B unlaundered figure, and the FBI–USSS–IRS-CI blocklist. The Nov 12 action is the first formal U.S. seizure order on this incident and the broadest DPRK crypto enforcement move of the quarter, pairing a one-event asset grab with a sector-wide takedown of the preferred social-engineering pipeline. For readers tracking the pattern: the FaceStealer playbook — prerecorded video plus deepfake inserts plus "fix link" — is the same template behind the NEAR AI sglang breach and the Lazarus-era 3CX and Ronin compromises.