Justice Department Wins Court Nod to Seize $1.2 Billion From Binance Hack

Court Authorization for $1.2 Billion

The U.S. Justice Department said Thursday it has obtained court authorization to seize or restrain over $1.2 billion in cryptocurrency stolen from Binance, the largest single tranche of the more than $2.7 billion investigators have frozen since the breach. The assets come from the roughly $6.4 billion taken from the exchange on Oct. 29, a theft the FBI attributes to TraderTraitor, a hacking unit tied to North Korea's military. The Oct. 29 breach ranks among the largest thefts from a single exchange on record. The department's announcement describes a joint tracing effort between U.S. agencies and crypto industry partners that has been running since the hack. Laundering has moved at extraordinary speed: the attackers have spun up a new wallet address roughly every 25 seconds to cycle the stolen funds, which forces recovery teams to work address by address. Officials said efforts to identify and claw back the remainder are ongoing. The FBI maintains that North Korea routes large-scale crypto theft into its weapons programs, a claim Pyongyang denies, dismissing the attribution as a political provocation.

FaceStealer's Deepfake Video Trap

A second operation announced the same day targeted the infrastructure behind FaceStealer, the FBI's name for a social-engineering campaign that has drained more than $400 million in cryptocurrency over 18 months. On video calls, attackers operating accounts stolen from earlier victims lure targets into meetings, then play prerecorded webcam footage of trusted contacts to simulate their presence; some sessions feature AI-generated deepfakes of well-known figures in crypto and adjacent industries. Once a target relaxes, the operators stage a technical problem, such as insisting the victim cannot be heard, and send a link to fix it that installs malware instead. The malware can linger quietly, letting attackers map what a victim can reach before they move. From there they can drain funds directly or exploit the victim's access to connected systems, sometimes lying dormant for more than a year before striking. Authorities seized the cloud infrastructure used to run the campaign and, under a federal warrant, took control of more than 900 webcam recordings of victims. The department connects the operation to North Korean clusters tracked as Sapphire Sleet, BlueNoroff and APT38, and it warned that the hackers are increasingly going after open-source software developers, apparently to set up supply-chain attacks.

A $7.4 Billion Year for Pyongyang

The enforcement push lands at the end of a record year for North Korea-linked theft. Data compiled by blockchain analysis firm TRM Labs put the regime's 2026 haul at $7.4 billion as of Oct. 29, about 85 percent of all cryptocurrency hacking losses recorded worldwide. That share means nearly nine in ten dollars lost to crypto hackers this year trace back to one state. The Oct. 29 Binance breach is the largest single event behind that tally, and its proceeds are still moving. Freezing over $2.7 billion inside two weeks of the breach, between Oct. 29 and Thursday's announcement, still leaves the majority of the stolen funds outside U.S. reach. Washington has paired seizures with sanctions: the U.S. recently imposed measures on 11 people connected to a North Korean IT-worker scheme that generated millions in crypto, part of a wider effort to cut off the revenue American officials say funds weapons development. Public-ledger tracing gives investigators a durable trail, since every transfer leaves a permanent record, but the wallet-creation pace the department described complicates that work. How much of the unrecovered portion remains traceable has not been disclosed. Pyongyang, for its part, denies involvement and has dismissed the FBI's attribution as a political provocation.

What the Order Does Not Reach

The legal mechanics matter as much as the headline figure. A seizure or restraint order encumbers the listed assets and blocks their transfer, but outright forfeiture still requires a court to confirm the government's claim, so the $1.2 billion is not yet in federal custody. Based on the department's own figures, roughly $3.7 billion of the Binance haul sits outside any freeze, cycling through addresses that turn over every 25 seconds. Recovery therefore depends on where those funds exit public chains: conversions through regulated services are the points where U.S. authorities can actually act. With tracing and recovery continuing, additional seizure filings remain possible as investigators cluster more of the proceeds.