Skip to content
$BTC$71,413−3.7%$ETH$2,012−2.5%$SOL$81.36−3.3%$XRP$1.04−2.1%$TON$1.14−2.3%MCap$2.36T−4.2%BTC.D60.4%Fear&Greed28 FearGas0.18 gwei·2.2 sat/vBNews mood23% bullish
Basis Desk

New: Basis Desk Verify for Chrome & Firefox — fact-check crypto news on any page, free.Get the extension →

Security & Hacks · 1 min read

DOJ Restrains $1.2B in Stolen Binance Crypto, Dismantles FaceStealer Infrastructure

Federal authorities intervened after North Korea's TraderTraitor stole $6B from Binance, while also seizing servers used in a separate $400M deepfake scheme.

Editorial oversight: Julian Mercer, Chief Editor
Bearish
$BTC $71,413 −3.7%

At a glance Enforcement action

What happened
The DOJ obtained court orders restraining over $1.2B stolen from Binance and seized infrastructure behind North Korea's $400M FaceStealer scheme.
Why it matters
The enforcement actions intercept significant portions of a historic $6B exchange theft and disrupt state-sponsored supply chain cyber attacks.
Who is affected
Binance, virtual asset service providers, Web3 developers, and targets of North Korean social engineering operations.
Takes effect
2026-11-12
What's next
Ongoing forfeiture proceedings and asset tracing by the FBI, Secret Service, and IRS-CI as perpetrators attempt to launder funds.
Primary source
U.S. Department of Justice: Justice Department Announces Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency

Key points

  • DOJ restrained over $1.2B of $6B stolen from Binance by North Korean hacking collective TraderTraitor.
  • Joint public-private actions have frozen more than $2.7B in connection with the Oct. 29 Binance breach.
  • Authorities seized cloud servers and 900+ victim videos tied to FaceStealer, a $400M deepfake meeting scam.

The U.S. Department of Justice announced coordinated enforcement actions targeting North Korean cyber operations, securing court-authorized seizures and restraints on more than $1.2 billion in cryptocurrency stolen from Binance 1. Authorities also seized cloud-based infrastructure linked to "FaceStealer," an 18-month social engineering campaign that drained more than $400 million from crypto and Web3 targets 1.

The enforcement efforts address a massive breach that occurred on or about Oct. 29, when North Korean military hackers designated as "TraderTraitor" stole over $6 billion in digital assets from Binance 1. Following the theft, federal prosecutors, the FBI, the U.S. Secret Service, and the Internal Revenue Service worked alongside private virtual asset service providers to freeze more than $2.7 billion in funds 1. The DOJ has secured court authorization to seize or restrain over $1.2 billion of those frozen assets while the perpetrators continue attempting to launder funds across bridges, mixers, and exchanges 1. Law enforcement partners previously published a joint alert urging exchanges to block related transaction trails 1.

FaceStealer Campaign Disrupted

Concurrently, federal prosecutors in the Central District of California dismantled cloud infrastructure behind FaceStealer, an operation conducted by threat groups including Sapphire Sleet, APT38, and BlueNoroff 1. Hackers lured cryptocurrency personnel into compromised video calls, playing pre-recorded clips or deepfakes of trusted industry figures to trick victims into downloading malware disguised as meeting fixes 1. The malicious software compromised local systems to steal digital assets and target the open-source software supply chain 1. The FBI seized more than 900 victim webcam recordings collected during the operation 1.

The coordinated interdictions follow wider government measures tracking illicit state-sponsored finance, complementing efforts seen when regulators and courts escalate recovery actions in global crypto fraud cases 1. At the time of writing, market sentiment remains subdued with Bitcoin ($BTC) trading at $71,507. Law enforcement agencies confirmed that asset tracing, forfeiture proceedings, and international recovery operations related to the remaining Binance proceeds remain active 1.

Questions this story raises

How much cryptocurrency was stolen from Binance?
North Korean cyber actors stole more than $6 billion worth of virtual assets from Binance on or about Oct. 29.
How much of the stolen Binance funds have been recovered or frozen?
Public and private sector efforts have frozen more than $2.7 billion, with over $1.2 billion restrained or seized under court authorization.
What was the FaceStealer scheme?
FaceStealer was a social engineering campaign utilizing deepfakes and manipulated video calls to install malware, stealing over $400 million and compromising supply-chain developers.

Sources

  1. [1] Justice Department Announces Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency — U.S. Department of Justice, November 12, 2026

Written by Basis Desk's newsroom system from the primary sources above and machine-verified against them before publication. Market figures marked "at the time of writing" come from live exchange data. Report an error: corrections@basisdesk.news · corrections policy.

Community read
How do you read this story for the assets involved? One vote a day, anonymous.
Be the first to vote
Share X Telegram Bluesky Markdown

The Daily Brief, in your inbox at 07:00 ET

Five stories, the numbers that moved, what to watch. Three minutes. No hype, no advice, unsubscribe in one click.

Not financial advice. Basis Desk publishes information, not recommendations. Crypto assets are volatile and you can lose what you invest.