DOJ moves to seize $1.2 billion from North Korea's Binance hack

US prosecutors said on Thursday they won court orders to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, funds they trace to North Korean military hackers who drained the exchange of more than $6 billion on October 29.

That figure sounds like a recovery. It is not one yet. Announced by the Justice Department as release 26-1356, the orders cover money that was already frozen in wallets and at crypto service providers, part of more than $2.7 billion locked down since the breach. None of it has gone back to Binance.

What the court orders actually do

Seizing or restraining stolen crypto is a legal step, not the end of the story. Investigators and private firms had already frozen the coins in place. These orders hand the government legal control of $1.2 billion of that pile. Cashing it out or returning it comes later, if at all.

A. Tysen Duva, Assistant Attorney General in the Criminal Division, said the effort helped "immediately halt about half of this historic breach." That claim needs a caveat. The amount under court order, $1.2 billion, is under a quarter of what was taken. Count the wider $2.7 billion freeze and you get closer to half.

Who gets the money back, if anyone, is unsettled. Binance says it already covered customer losses from its own funds. It set aside about $6.34 billion and posted a fresh proof-of-reserves snapshot after the attack. So any released coins would most likely repay the company and the government, not individual users, who were never left short. Neither the department nor Binance has said how much of the $1.2 billion will return, or when.

Why the FBI points at North Korea

Crypto theft is not a side hustle for Pyongyang. US and United Nations investigators describe it as a core funding line for a sanctioned state cut off from normal banking, with proceeds flowing toward its weapons work. Against that backdrop, freezing $1.2 billion is less about one exchange made whole and more about denying a government the cash. Brett Leatherman, the FBI's Cyber Branch operations director, said as much: "The North Korean regime relies on proceeds from large-scale cryptocurrency theft."

Blame for the October breach falls on a group the FBI calls TraderTraitor, which it describes as members of the North Korean military. A bureau cyber alert last week told crypto firms to block transactions tied to the laundering addresses. Frozen, not recovered. That distinction runs through the whole case.

M. Scott Proctor, Principal Deputy Assistant Attorney General for National Security, gave the motive in one line. "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," he said. Investigators have made that charge for years. Pyongyang has long denied it.

Right now the stolen funds are still in motion. Investigators say the hackers keep pushing what remains through bridges, mixers and other exchanges, the usual laundering route. US authorities have leaned on that choke point before, barring American banks from one offshore exchange only last week. That is why the freeze matters more than the headline. Every flagged wallet is one the thieves cannot spend.

There is a limit to what a freeze can do. Once stolen coins pass through enough mixers and bridges, tracing them gets harder and slower, and some always slip out before the flags go up. Public blockchains help investigators follow the money, but they do not force anyone to hand it back. The gap between what is frozen and what is spendable is where this fight is won or lost.

A deepfake scam ran alongside the hack

A second operation came out in the same announcement. Agents call it FaceStealer, and it is separate from the Binance theft. It drained more than $400 million from crypto and Web3 workers over roughly 18 months, according to the FBI.

This scheme leaned on trust, not clever code. Attackers used hijacked accounts to pull targets into video calls, played recorded footage or deepfakes of people the victim knew, then faked a technical glitch and walked them into installing a "fix" that was malware. More than 900 secretly recorded webcam videos were seized, the FBI said, clips the group reused to pose as victims in later attacks.

Patrick Grandy, Assistant Director in Charge of the FBI's Los Angeles Field Office, said the scam "exploits our trust in ubiquitous video conference platforms and valued personal relationships." Open-source software developers were among the marks. That points at a longer game, a way into the code that thousands of other projects quietly depend on.

For ordinary holders, the direct risk from FaceStealer is low unless they work in crypto or open source. The targets were employees and developers with access to funds or code. Still, the playbook travels. The same deepfake tricks already show up in romance scams and fake support calls aimed at retail users, which is why the FBI issued guidance for anyone who thinks they were filmed.

What to watch

Watch whether prosecutors file forfeiture complaints to turn the $1.2 billion into permanent custody, and whether any of it ever lands with Binance. Watch the laundering addresses too. As more firms and exchanges block them, the slice Pyongyang can actually spend shrinks. US prosecutors have logged other crypto-theft wins lately, including the conviction of a former FBI agent who stole seized bitcoin. That is the real contest here, and it is slow.

FaceStealer is the quieter warning. Deepfake video is cheap now, and good enough to fool careful people. For anyone who holds crypto, the takeaway is dull and worth repeating. Slow down on any video call that ends with a request to install something.