DOJ Targets $1.2B in Crypto Stolen From Binance

The US Department of Justice DOJ targets the stolen crypto from Binance after it secured court authorization to seize more than $1.2 billion in cryptocurrency stolen during the massive Binance hack in October. The announcement marks a significant development in the recovery effort, as authorities also revealed the disruption of a separate North Korean cybercrime operation that allegedly stole more than $400 million through deepfake-enabled scams.

The Binance theft, which occurred around October 29, involved more than $6 billion in digital assets, according to the DOJ. Government agencies and private-sector partners have since frozen more than $2.7 billion of the stolen funds, with the latest court action covering a portion of that amount.

DOJ Secures Court Approval to Seize $1.2 Billion From Binance Hack

The FBI attributed the Binance attack to TraderTraitor, a hacking operation linked to North Korea’s military. Investigators say the group stole more than $6 billion in virtual assets before moving the funds through cryptocurrency bridges, mixers, and exchanges in an attempt to obscure their origins.

The DOJ’s latest action allows authorities to seize or restrain more than $1.2 billion of the stolen cryptocurrency. However, this amount is included in the broader $2.7 billion already frozen through cooperation between US agencies and private companies. It does not represent an additional recovery.

US officials say the government is continuing to trace the remaining assets and coordinate with virtual asset service providers to prevent further movement of the stolen funds.

Binance previously estimated its losses at approximately $6.3 billion and committed company resources to cover the affected assets. On November 12, the exchange said it had completed that process and published an updated proof-of-reserves snapshot.

The DOJ described the recovery effort as a coordinated operation involving its National Security Division, Criminal Division, the FBI, and other law enforcement partners. Officials also emphasized that North Korea has relied on cryptocurrency theft to generate funds for its government and weapons programs.

FaceStealer Operation Used Deepfakes to Steal More Than $400 Million

Alongside the Binance-related enforcement action, the DOJ announced that authorities had seized cloud infrastructure used in a separate North Korean hacking campaign known as FaceStealer.

According to the department, the operation has resulted in more than $400 million in cryptocurrency theft over the past 18 months. Rather than relying solely on conventional phishing messages, the attackers used compromised accounts, recorded webcam footage, and AI-generated deepfakes to impersonate people familiar to their targets.

The scheme typically began with an invitation to an online meeting sent through an account previously stolen from another victim. Once the target joined, hackers played prerecorded footage or deepfake videos of people they recognized to establish trust.

The attackers would then introduce a fake technical problem, such as an audio malfunction, and instruct the victim to install software supposedly needed to resolve it. The download instead installed malware that provided access to the victim’s computer, cryptocurrency holdings, and other systems.

In some cases, attackers waited months or even more than a year after the initial compromise before stealing funds or taking control of communication accounts. The FBI also seized more than 900 webcam videos belonging to victims as part of the investigation.

North Korean Hackers Also Targeted Open-Source Software Developers

The FaceStealer campaign extended beyond cryptocurrency investors and Web3 professionals. US authorities said the hackers increasingly targeted developers responsible for maintaining open-source software, raising concerns about potential supply-chain attacks.

By compromising a developer’s computer or repository account, attackers could potentially introduce malicious code into software used by other individuals and organizations.

The DOJ said the campaign appeared intended to exploit the trust placed in widely used software and professional relationships. The FBI’s investigation also identified attempts to use compromised accounts and contact lists to approach victims’ colleagues and personal connections.

The seizure of FaceStealer infrastructure is intended to disrupt the operation and limit the attackers’ ability to continue targeting cryptocurrency users and software developers. The FBI has also published guidance to help potential victims identify the scheme and respond to possible compromises.

What the DOJ Actions Mean for Crypto Security

The two enforcement actions highlight the growing scale and sophistication of North Korean-linked cybercrime targeting the digital asset industry. While the Binance case demonstrates the financial impact of large-scale exchange breaches, FaceStealer illustrates how social engineering and deepfake technology can expose individuals and organizations to substantial losses.

The recovery of the Binance funds also shows the importance of cooperation between law enforcement agencies, exchanges, blockchain analytics firms, and other crypto service providers. However, freezing stolen assets does not automatically mean they have been returned to their rightful owners. Further legal proceedings and asset-tracing efforts remain necessary.

With more than $1.2 billion now covered by court-authorized seizure or restraint orders, US authorities have taken another step toward recovering funds connected to one of the largest cryptocurrency thefts on record. Meanwhile, the disruption of FaceStealer signals that investigators are also focusing on the techniques used to compromise individuals before funds are stolen.

Do you think the DOJ’s latest actions will make it harder for North Korean hackers to target cryptocurrency exchanges?

Could the growing use of AI-generated deepfakes make social engineering one of the biggest security threats facing the crypto industry?