DOJ Wins Court Authority Over $1.2 Billion of the Binance Haul and Names FaceStealer

The U.S. Department of Justice has obtained court authorization to seize or restrain in excess of $1.2 billion of cryptocurrency stolen from Binance, and separately seized cloud infrastructure used in a North Korean social engineering campaign the FBI now calls “FaceStealer.” The announcement, published on 12 November as press release 26-1356, separates two operations that share one actor: a webcam-based scheme that has taken more than $400 million from individuals over 18 months, and the theft of more than $6 billion from an exchange on or about 29 October.

The Binance theft remains the largest in the industry’s history, and the department’s own figure is the round one. Binance put the loss at $6.34 billion in the findings report it published on 3 November, and analytics firm Elliptic has tracked $6.43 billion across more than 20,000 wallets. Those numbers differ by method and by date of measurement, and the Justice Department’s release sticks to “more than $6 billion.”

For anyone who has followed the case since the first $2.5 billion leaving a single Binance hot wallet, the news here is not the size. It is the legal instrument. A freeze is something a compliance desk does when the FBI publishes an address list. A seizure or restraint order is something a court grants over specific property, and it is the first step on the path that ends in forfeiture.

What a court order to seize actually changes

The release describes two distinct legal actions: “the court-authorized seizure and restraint of more than $1.2 billion worth of cryptocurrency recently stolen from Binance,” and the seizure of cloud infrastructure under a federal warrant in the FaceStealer matter. It then says that efforts to “trace, freeze, seize, and forfeit the stolen virtual assets are ongoing,” with TraderTraitor actors still laundering through bridges, mixers and exchanges.

That wording matters. Restraint is an order that holds property in place. Forfeiture is the transfer of title to the government, and it comes after a separate proceeding. The department does not state in this release that a forfeiture judgment has been entered, does not name any individual defendant, and does not announce charges against anyone for the 29 October theft. What it announces is control over assets and the destruction of a scheme’s working infrastructure.

Jeanine Ferris Pirro, the U.S. Attorney for the District of Columbia, framed the seizure as the point of the exercise. “The North Korean regime may think they are sophisticated cyber criminals, but we have consistently met them head on, as we did here seizing more than $1.2 billion of their stolen assets,” she said.

Whether that seizure converts into restitution depends on steps the release does not describe. Confiscated assets do not automatically return to the exchange or its users, and no mechanism is set out here. The department says it will “seize and return” the funds; the return path is the part still to be built.

The $1.5 billion between frozen and court-authorized

Two figures in the release sit close enough together to be read as one number, and they are not. The department says collective U.S. government and private sector efforts have resulted in the freeze of “more than $2.7 billion,” and that it has court authorization to seize or restrain “in excess of $1.2 billion” of that amount.

The subtraction is the story. About $1.5 billion is frozen but not yet under a court order. Against a theft of more than $6 billion, the freeze covers roughly 45%, and the court-authorized portion covers about 20%. Of the money already stopped, the department has court authority over roughly 44%.

That roughly matches how A. Tysen Duva, Assistant Attorney General of the Criminal Division, described the result: “the Criminal Division quickly and efficiently used its expertise to immediately halt about half of this historic breach.” About half is 45%, and the phrasing points at the freeze, not at the seizure.

The gap is structural rather than a shortfall. Freezing happens at the intermediary: a VASP receives an address list, blocks deposits and files a suspicious activity report, and no court is involved. Seizing requires tracing specific wallets to a jurisdiction the United States can reach, which takes longer than publishing an address. The release does not explain the difference; the two mechanisms do.

It is also worth not reading a trend into the total. Binance said on 30 October that about $3 billion had been frozen. Elliptic put the figure at $2.85 billion as of 6 November. The department’s 12 November number is $2.7 billion. These come from three different parties measuring at three different moments, and treating them as one series would invent a decline that no source asserts.

FaceStealer: a video call with a person who is not there

The second half of the announcement is the more transferable lesson for anyone holding crypto. The FBI’s 12 November FLASH, published with the department’s release, lays out the scheme in six stages, and its effectiveness does not depend on malware sophistication. It depends on a recorded face.

The chain starts with an already compromised victim. The actors scan the device for wallets and seed phrases, take over the victim’s Telegram or another encrypted messaging account, and record the victim on webcam while they wait for a meeting to begin. They then message the victim’s contacts from that genuine account, proposing a call to “catch up” or discuss an investment, and send a Calendly invite. Shortly before the meeting, a link arrives. It is not Zoom. The FLASH lists typo-squatted domains the actors registered for this purpose, including -uu01webzoom.us and teams.livemeet.us, serving copycat interfaces built to be indistinguishable from the real ones.

Once the target joins and is admitted, the recorded video of the contact plays, often alongside additional recordings to simulate a room with several participants. Then comes the audio problem. The hacker, still playing the trusted contact, says the target cannot be heard and offers a fix: an update prompt, a script, or code to paste into a terminal. Following it installs a browser cookie harvester, keyloggers, a screen capture tool and a backdoor.

Patrick Grandy, Assistant Director in Charge of the FBI’s Los Angeles Field Office, described why the method works: “It exploits our trust in ubiquitous video conference platforms and valued personal relationships.” He added a line that reads as an instruction to the sceptical: “If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough.”

The FBI seized more than 900 victim webcam videos under a federal warrant. Those recordings are the scheme’s inventory, and each one is a reusable identity credential.

Why the theft lands months, or a year, after the hack

The detail most likely to be underestimated is timing. The FLASH states that in several reported cases the hackers stole cryptocurrency and hijacked communication accounts months to more than a year after the initial compromise, waiting for wallet balances to grow. Recovery phrases copied from a device can be held indefinitely and used once the address is worth emptying.

That changes what “we contained it” means. A compromised laptop with an empty wallet is not a closed incident, and the FBI’s guidance reflects it: create a new wallet with new seed phrases on a device that was not used to talk to the attackers, move the assets, then rotate passwords, end all active sessions, add multifactor authentication to messaging and developer accounts, and tell contacts they may be impersonated with recorded video.

Brett Leatherman, Director of the FBI’s Cyber Branch Operations, put the scale in a sentence. “North Korean cyber actors have used the FaceStealer scheme to aggressively target individuals in the cryptocurrency and Web3 sectors through deceptive social engineering tactics, resulting in the theft of more than $400 million in the last 18 months,” he said.

The supply-chain turn, and why crypto should read that part twice

The FLASH contains a warning that reaches beyond individual wallets. The same technique has been aimed at open-source maintainers, with the goal of access to devices and repository accounts. The FBI describes one attempt in which a maintainer of a widely used JavaScript library was lured into a fake Teams call with multiple apparent participants, one of them recognisable, and followed “corrective” instructions that infected his machine. The actors then used his access to create malicious dependencies that would ship with legitimate downloads of a library the FLASH says receives tens of millions of downloads per week. Quick detection stopped it.

The FLASH says other attempts have targeted maintainers with repositories on the JavaScript registry and the Node Package Manager, and more recently maintainers of Rust crates. It does not name the library involved in the near-miss, and it does not claim that crypto-specific packages were the target. What it establishes is the multiplier: one compromised maintainer can reach every downstream user of a dependency, which for wallet software and exchange front-ends is the entire customer base.

628 addresses and the compliance instruction behind them

The remediation the FBI is asking for is concrete and unusually large in scope. The 31 October cyber alert, issued with the Secret Service and IRS Criminal Investigation, publishes a list of addresses the actors are using: 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address, 628 in total. It asks THORNode operators, RPC node operators, instant exchanges, DeFi services, analytics firms and other virtual asset service providers to block transactions “with or derived from” them.

The composition of that list is itself informative. The FBI says the actors converted the stolen assets primarily into ether, expecting to move them through DeFi and instant swap services before the next laundering stage. The bitcoin leg came later and in smaller size: by 6 November, Elliptic had counted about 1,650 BTC, then worth roughly $124 million, in addresses funded from the theft, as we reported on the shape of that conversion.

Set 628 against the volume the tracing firms describe, more than 20,000 wallets across 16 blockchains and at least 65,000 transactions, and the list reads for what it is: a perimeter, not a map. Blocking those addresses closes the routes the FBI can see today. It does not close the next set of addresses, which is why the department’s own release says laundering is continuing.

What the announcement leaves open

Four things remain outside the frame. The first is recovery for FaceStealer victims: the release gives the size of the loss, more than $400 million over 18 months, and no figure for what has been returned to the people it was taken from. The second is individual accountability, as no person is named, charged or extradited in this release.

The third is the exchange’s own position. Binance said on 31 October that 98% of affected assets had been replenished and that it had set aside more than the funds required to absorb the loss rather than pass it to users, which means the seizure is a recovery for the estate, not a rescue of customer balances. The fourth is what a forfeiture action would look like, including whether any of it reaches the users whose assets were taken.

M. Scott Proctor, Principal Deputy Assistant Attorney General for National Security, described the intent without describing the mechanism. “North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” he said, adding that the National Security Division “will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.”

The tools are now visible: an address list, a warrant against infrastructure, and a court order over $1.2 billion. The return is the part still pending.

Frequently Asked Questions

How much of the Binance hack has been recovered?

The Justice Department said on 12 November that collective government and private-sector efforts had frozen more than $2.7 billion of the more than $6 billion taken on or about 29 October, and that it has court authorization to seize or restrain in excess of $1.2 billion of that amount. Frozen assets are held in place; only the $1.2 billion is under a court order, and no forfeiture judgment has been announced.

What is FaceStealer?

It is the FBI’s name for a North Korean social engineering scheme that lures targets into fake Zoom, Teams or Meet calls, plays secretly recorded webcam video of a contact the target knows, then introduces a fake audio problem whose “fix” installs malware. The FBI says it has taken more than $400 million over 18 months and seized over 900 victim videos used to impersonate people in later attacks.

Has anyone been charged over the Binance theft?

Not in this announcement. The 12 November release describes asset seizure and restraint, the seizure of FaceStealer cloud infrastructure, and ongoing tracing, freezing and forfeiture efforts. It names no individual defendant and announces no charges connected to the 29 October theft.

What should I do if I joined a suspicious video call and ran a script?

The FBI’s guidance is to create a new wallet with new seed phrases on a device that was not used to communicate with the suspected attackers and move assets there, then change passwords, end all active sessions, add multifactor authentication to messaging and developer accounts, and warn contacts that recorded video of you may be used to impersonate you. Reports can be filed at ic3.gov using the keyword FaceStealer.

---

This article is based on the Justice Department’s 12 November 2026 press release 26-1356, the FBI’s 12 November FaceStealer FLASH and the FBI’s 31 October cyber alert on the Binance theft. It is not investment advice.