US seizes $1.2 billion in crypto stolen from Binance hack

US moves to seize stolen Binance funds

The Department of Justice said on Thursday that it had obtained court permission to seize or restrain more than $1.2 billion in cryptocurrency taken from the exchange Binance, according to CNBC. The theft, which occurred on 29 October, is estimated at over $6 billion and is attributed to hackers linked to the North Korean military.

Combined action by the US government and private companies has so far frozen more than $2.7 billion of the stolen total. The DOJ described its move as part of a coordinated response to what it called North Korean efforts to fund its regime through large-scale cryptocurrency theft.

The FBI's case against TraderTraitor

The FBI blames the October breach on military-linked hackers it calls TraderTraitor. According to CNBC, the attack shook confidence in the security of the crypto market when it became public.

Investigators from the DOJ, partner law enforcement agencies and companies that handle virtual assets are working together to intercept the money. The task is far from finished: the DOJ says the hackers keep moving the funds through different crypto channels to launder them, so freezing operations continue.

FaceStealer scam infrastructure taken down

In the same announcement, the DOJ said it had disrupted cloud servers used by a scam it labels FaceStealer. This campaign reportedly stole more than $400 million over 18 months.

The scheme works through deception. Attackers set up fake video meetings using hijacked accounts and AI-generated deepfakes of people the target trusts, according to the research notes. They claim a technical problem needs fixing, persuade the victim to install malicious software, then take over their communications, drain their crypto and go after their contacts. The damage can surface months later, or more than a year after the first compromise. People working in crypto and web3 are considered prime targets.

What officials are saying

Patrick Grandy, Assistant Director in Charge at the FBI's Los Angeles Field Office, described FaceStealer as a scheme able to fool even experienced and security-conscious computer users. He noted it exploits trust in common video conferencing tools and personal relationships, and warned that anyone who cannot imagine falling for it is not thinking creatively enough.

M. Scott Proctor, Principal Deputy Assistant Attorney General for National Security, said North Korea's government finances its regime and weapons programmes through cryptocurrency theft. He said the National Security Division would use every available tool to seize and return the stolen gains.

Why it matters

The seizure is one of the largest reported US actions against state-linked crypto crime, and it shows how investigators now work with private firms to trace stolen digital assets in near real time.

For people in the crypto industry, the FaceStealer details are a practical warning. A convincing video call with a familiar face is no longer proof of identity, and the DOJ urges anyone in these sectors to treat unusual requests for software installation with caution. Readers can follow official DOJ guidance for advice on recognising such scams.