US seizes $1.2 billion linked to Binance theft and disrupts North Korean FaceStealer tools

The Justice Department said it obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance during a $6.3 billion breach last month. The action is part of a larger $2.7 billion freeze involving several cryptocurrency platforms. Assistant Attorney General A. Tysen Duva said multiple DOJ divisions moved quickly to halt about half of the breach before assets moved beyond reach. Binance and the FBI attributed the theft to TraderTraitor, a North Korean hacking group; the announcement did not detail independent technical confirmation.

The evidence trail runs through blockchain tracing and platform freezes. The DOJ said efforts to trace, freeze, seize and forfeit remain ongoing while TraderTraitor launders assets through cryptocurrency bridges, mixers and exchanges. Blockchain security firms reported novel automated laundering methods. Elliptic said North Korean launderers created worthless tokens and moved stolen crypto through decentralized exchange liquidity pools so funds did not pass directly from stolen-asset wallets to receiving wallets. The technique was used after the $1.4 billion Bybit theft.

The seizure sits alongside a separate FBI and DOJ disruption of FaceStealer, a social engineering campaign tied to North Korean hackers and more than $400 million in cryptocurrency theft over 18 months. Investigators seized more than 900 webcam videos from cloud infrastructure. The scheme used stolen Calendly invitations, fake Zoom or Teams domains, pre-recorded videos and deepfakes to trick users into installing malware, then reused victims' images for further scams. Officials said they have not determined the first victim or whether FaceStealer was used to breach Binance.

The financial stakes are direct: Binance users, cryptocurrency platforms and the broader crypto market face losses from theft and laundering, while U.S. authorities show they can intercept some stolen digital assets when exchanges and blockchain data cooperate fast enough. For North Korea, the operation targets revenue streams that the FBI says fund its illicit weapons program. For individuals and firms, the FaceStealer seizure exposes a practical risk: video-meeting trust can be turned into malware access and identity reuse.