US Seizes $1.2 Billion in Stolen Crypto from Binance Hack
DOJ targets North Korean hackers
In this article
Background on the binance hack
The Binance hack occurred on Oct. 29, with authorities attributing it to North Korea 6. The hack resulted in the theft of $6.3 billion in digital assets 6. Binance used a combination of company profits and emergency reserves to restore most of the stolen tokens 6.
According to reports, the hackers employed complex methods to obscure the stolen funds 6. They transferred tokens through thousands of digital wallets and across multiple blockchains 6. Blockchain analytics firm Elliptic reported that the laundering operation utilized more than 20,000 wallets 6.
The US DOJ has since obtained court approval to seize $1.2 billion of the stolen funds 1. The seizure is a significant development in the case, with Binance having already recovered all $6.3 billion in digital assets 6. The hack had targeted various cryptocurrencies, including Bitcoin 6.
US seizes $1.2 billion in stolen crypto
North korean hacking schemes
North Korean hackers have been using a deepfake scheme to steal crypto, known as FaceStealer 3. The scheme uses recordings and deepfakes to impersonate trusted contacts, resulting in over $400 million in losses 3. Officials attribute these losses to FaceStealer over 18 months 3.
Recently, hackers lure targets into meetings using accounts stolen from previous victims, then play prerecorded webcam footage of trusted contacts 4. The group also generates deepfake videos of well-known figures in the crypto and related industries, using AI to make the ruse more convincing 4. The FBI calls this scheme FaceStealer 4.
The FBI said it seized over 900 webcam recordings of FaceStealer victims under a federal warrant 4. The DOJ tied the operation to North Korean groups known as Sapphire Sleet, BlueNoroff and APT38, among others 4. These groups have increasingly targeted open-source software developers 4.
US response to the hack
Policymakers have taken notice of the US DOJ's action to disrupt the North Korean hacking schemes, including the seizure of $1.2 billion in stolen crypto 1. It uses secretly recorded footage and AI deepfakes to steal cryptocurrency. Meanwhile, the operation is tied to North Korean groups 4. The FBI calls the scheme FaceStealer 4.
Following the investigation, hackers lure targets into meetings using accounts stolen from previous victims 4. Still, the group generates deepfake videos of well-known figures in the crypto industry 4. The FBI seized over 900 webcam recordings of FaceStealer victims under a federal warrant 4. Consequently, the recordings are part of the evidence against the hackers 1.
Even so, the US has sanctioned 11 people over a North Korean IT-worker scheme that moved millions in crypto 4. Approximately 1 in 4 of these transactions occurred at incredibly high speeds, with the regime laundering the proceeds at speed, spinning up a new wallet roughly every 25 seconds 4. The FBI attributed the Binance hack to the North Korean group TraderTraitor 4. The company is working to recover the stolen funds 1.
What it means for readers
Ultimately, the US seizure of $1.2 billion in stolen crypto from the Binance hack is a significant step 1. As a result, this action disrupts North Korean hacking schemes, which have caused over $400 million in losses 3. Furthermore, the seizure affects Binance users who had assets stolen. Hence, it provides some relief to affected users.
The Fed has likely taken note that Binance's restoration of all $6.3 billion in stolen assets is a positive development for users 6. They used a combination of profits and emergency reserves to restore most tokens within days. Notably, approximately 10% of the funds required more time to recover. Therefore, this recovery process was complex.
The use of deepfake schemes to steal crypto is a growing concern for investors and users 3. Officials attribute more than $400 million in losses to FaceStealer, which uses recordings and deepfakes 3. Binance's experience shows the importance of security measures. The company's restoration of stolen assets provides some reassurance to users 6.
What isn't known yet
The full extent of the North Korean hacking schemes is still unknown 4. The group's tactics, such as using AI deepfakes, are becoming more sophisticated 4. This raises concerns about the potential for future attacks 4. The US Justice Department is still investigating the matter 4.
The identity of the individuals behind the TraderTraitor group is still unknown 4. The group's connection to other North Korean hacking groups, such as Sapphire Sleet and BlueNoroff, is also unclear 4. The FBI has attributed the Binance hack to TraderTraitor, but more information is needed 4. The investigation is ongoing 4.
The impact of the US sanctions on North Korean crypto activities is still unclear 4. The sanctions targeted 11 individuals involved in a North Korean IT-worker scheme 4. The scheme moved millions of dollars in crypto, but the full extent of its operations is unknown 4. The US is continuing to monitor the situation and take action as needed 4.
Frequently asked questions
What is the FaceStealer scheme?
The FaceStealer scheme is a deepfake scheme used by North Korean hackers to steal crypto, resulting in over $400 million in losses 3.
How much crypto was stolen in the Binance hack?
The Binance hack resulted in the theft of $6.3 billion in digital assets 6.
About this article
Our system reads Bitcoin, Ethereum, crypto markets, regulation and DeFi coverage from established publishers every hour. A story is only written when at least three independent outlets report it. Every figure must appear in a cited source, and each draft passes automated checks for accuracy, originality and readability. Drafts that score highly on every check publish automatically; the rest wait for a human editor. Drafted with AI assistance from the sources listed. Not financial or professional advice.
- Published.
- coindesk.com: North Korea's Binance hack faces U.S. crackdown as DOJ targets $1.2 billion in stolen crypto · Nov 12, 2026 ET
- theblock.co: DOJ moves to seize $1.2 billion from Binance hack, disrupts North Korean deepfake scheme · Nov 12, 2026 ET
- thedefiant.io: DOJ Disrupts North Korean Fake-Call Crypto Theft Scheme · Nov 12, 2026 ET
- decrypt.co: North Korea Stole $400 Million in Crypto Using Deepfake Video Calls, DOJ Says · Nov 12, 2026 ET
- Bloomberg.com: US Details $2.7 Billion Freeze After North Korea’s Binance Hack · Nov 12, 2026 ET
- Yahoo Finance: Binance restores all $6.3 billion stolen in October hack · Nov 12, 2026 ET
- CoinGecko market data (delayed): Bitcoin and Ether prices at Nov 12, 2026 19:00 ET · Nov 12, 2026 ET
Every new story, with its sources, as it publishes.
