DOJ wins approval to seize $1.2B from the Binance hack and takes down a North Korean deepfake operation

The U.S. Department of Justice said Thursday it has obtained court approval to seize or restrain more than $1.2 billion of the cryptocurrency stolen from Binance in late October, and that in a separate operation federal agents took control of the cloud infrastructure behind a North Korean scheme that used fake video calls and deepfakes to steal crypto. Both actions were attributed to North Korea, and both were reported by The Block and CoinDesk based on the DOJ's announcement.

The Binance seizure

The $1.2 billion the DOJ now has authority to seize is a slice of a larger pool. More than $2.7 billion of the stolen funds have been frozen through the combined efforts of U.S. authorities and private companies, the DOJ said, and investigators are still tracing assets as the hackers route them through blockchain bridges, mixers and exchanges. In other words, the court order covers what has been located and frozen so far — not the full theft, and not a recovery that has reached victims.

The DOJ attributed the Binance breach to a North Korean military-linked hacking group it calls TraderTraitor, and dated the attack to on or around Oct. 29. On the size of the theft, the sources are close but not identical. The Block, citing the DOJ, put it at "more than $6 billion." CoinDesk likewise said "more than $6 billion," while its own headline and a linked explainer refer to a "$6.3 billion" heist. Binance's own accounting is more specific: the exchange previously put its losses at about $6.3 billion and said it set aside $6.34 billion in company funds to cover them — figures that come from Binance itself, an interested party, not an independent audit.

"North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," said M. Scott Proctor, principal deputy assistant attorney general for national security, in a statement quoted by both outlets. "The National Security Division will use every tool at its disposal to seize and return North Korea's ill-gotten gains."

Earlier the same day, according to The Block, Binance said it had "completed coverage" of the assets affected by the hack and published a new proof-of-reserves snapshot. That is Binance's characterization of its own remediation; neither outlet reported independent verification of the snapshot.

FaceStealer: the deepfake video-call scheme

The second, unrelated operation targeted a campaign the FBI calls FaceStealer, which the bureau says has stolen more than $400 million in crypto over the past 18 months. (CoinDesk framed the figure as "as much as $400 million"; The Block as "more than $400 million" — the DOJ's own wording appears to be the source of the gap.)

The mechanics, as described by both outlets: hackers used stolen accounts to invite victims to video meetings designed to look like Zoom or Microsoft Teams calls. To impersonate trusted contacts, they played secretly recorded webcam footage from earlier victims and, increasingly, AI-generated deepfake videos. Once a target joined, the attackers claimed there was a technical fault and instructed the victim to install software or run a command to "fix" it — which instead installed malware capable of draining crypto wallets and opening access to other systems.

Several details point to a long, patient operation. In some cases, the DOJ said, the takeover of a victim's communication accounts happened months — sometimes more than a year — after the initial computer compromise. The attackers reused stolen contacts and accounts to reach new targets, including developers who maintain widely used open-source software, a foothold that could in principle be used to push malicious code downstream. The FBI said it seized more than 900 webcam videos collected by the attackers and has issued guidance for those affected.

"It exploits our trust in ubiquitous video conference platforms and valued personal relationships," said Patrick Grandy, assistant director in charge of the FBI's Los Angeles Field Office, as quoted by The Block. "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."

Key facts

• $1.2 billion — amount the DOJ has court approval to seize or restrain from the Binance hack (DOJ, via The Block and CoinDesk).
• $2.7 billion+ — total frozen so far by U.S. authorities and private firms (DOJ).
• ~$6 billion / $6.3 billion — reported size of the Binance theft: "more than $6 billion" per the DOJ; ~$6.3 billion loss and $6.34 billion set aside per Binance's own statements.
• Oct. 29, 2026 — approximate date of the Binance attack, attributed to the North Korean group TraderTraitor (FBI/DOJ).
• $400 million+ — crypto stolen via the FaceStealer deepfake scheme over 18 months (FBI); CoinDesk reported "as much as," The Block "more than."
• 900+ — webcam videos of victims seized by the FBI.

The real-world read

A court order to seize $1.2 billion is not $1.2 billion returned to anyone. The DOJ has authority over what has been frozen; the funds are still being traced through bridges and mixers, and even the $2.7 billion frozen is less than half of a theft the department itself puts north of $6 billion. Watch for the word "seize" to be read as "recovered" — the sources don't support that yet.

The numbers also deserve a skeptical eye on provenance. The most precise figures — a $6.3 billion loss and $6.34 billion set aside — come from Binance, which has an obvious interest in showing the hole is covered. The exchange's same-day claim to have "completed coverage" and its fresh proof-of-reserves snapshot are self-reported; a proof-of-reserves snapshot shows assets on hand at a moment in time, not an independent audit of liabilities, and neither outlet reported third-party verification. The timing — a remediation announcement landing the same day as the DOJ's enforcement news — is convenient for Binance's messaging.

Both articles are secondary accounts of a single DOJ announcement, so their corroboration reflects a common source rather than independent confirmation. The underlying DOJ filings and FBI guidance are the primary documents; the specific terms of the seizure order, and how much of the $1.2 billion is actually recoverable, weren't detailed in either report.

One more note on context: CoinDesk's page carried a sponsored item promoting "diversified RWA stablecoins" and their yields. That is marketing, unrelated to this story, and plays no part in it.

Opinion, and whose

• The DOJ, via Proctor, frames North Korean crypto theft as state financing for weapons programs and pledges to "use every tool" to claw funds back — an enforcement posture, not a neutral fact about recovery odds.
• The FBI's Patrick Grandy argues the deepfake scheme's danger lies in exploiting trust in everyday video platforms, and warns that anyone who thinks they're immune "is not thinking creatively enough."
• CoinDesk, in a linked piece, noted that Binance co-founder CZ has warned of more AI-driven hacks following the breach — a prediction attributed to him, not an established trend.

Sources

• The Block (Tier 2, reputable secondary), "DOJ moves to seize $1.2 billion from Binance hack, disrupts North Korean deepfake scheme," Nov. 12, 2026 — reporting on the DOJ announcement; the $1.2B seizure, $2.7B frozen, TraderTraitor attribution, FaceStealer mechanics and figures, the Proctor and Grandy quotes, and Binance's self-reported coverage and proof-of-reserves claims.
• CoinDesk (Tier 2, reputable secondary), "North Korea's Binance hack faces U.S. crackdown as DOJ targets $1.2 billion in stolen crypto," Nov. 12, 2026 — corroborating the seizure and FaceStealer details, the Oct. 29 date, the deepfake/video-call method, and the CZ warning via a linked article. The page also carried an unrelated sponsored promotion for RWA stablecoins, which was not used.
• Primary (reported, not independently obtained here): the U.S. DOJ announcement and FBI guidance underlying both articles; Binance's own loss figures, remediation statement and proof-of-reserves snapshot (interested-party statements).

This is news reporting, not financial advice.