US freezes $1.2 billion from the Binance theft as FBI details a second North Korean crypto scheme
Authorities say they restrained assets from a record cryptocurrency theft and seized infrastructure used in a separate FaceStealer social-engineering campaign.
- Development
- 12 November 2026
- Coverage
- Breaking news
- Current status
- Developing case
- Source record
- 3 verified sources
Court orders cover more than $1.2 billion
The Justice Department said federal courts authorized the seizure and restraint of more than $1.2 billion in cryptocurrency stolen from Binance. The FBI attributes the underlying theft, valued at about $6.3 billion, to a North Korean hacking cluster known as TraderTraitor. Authorities and private companies have frozen more than $2.7 billion in total, according to the Associated Press. A forfeiture case will allow courts to determine ownership and whether recovered assets can be returned. The announcement describes a law-enforcement action, not a completed distribution to victims. [1] [2]
FaceStealer used compromised contacts and fake video calls
Officials also disclosed a separate social-engineering campaign called FaceStealer. The FBI says attackers compromised messaging and social-media accounts, recorded victims and then approached their contacts through fake versions of familiar video-meeting platforms. Targets were prompted to click a supposed technical fix that installed malware and exposed accounts or devices. Investigators attributed that activity to another North Korean cluster, Sapphire Sleet, also tracked as UNC1069. The Justice Department said the campaign stole more than $400 million in cryptocurrency during the previous 18 months. [1] [2] [3]
Infrastructure and victim videos seized
The FBI said it identified and seized more than 900 webcam videos of victims and that the Justice Department took control of cloud infrastructure used in the campaign. Officials warned that attackers are also experimenting with artificial intelligence to create convincing deepfake video of people known in the cryptocurrency and open-source software communities. The scheme depended on trust created by a genuine contact’s compromised account, making ordinary sender recognition an unreliable safeguard. Authorities urged targets to verify unusual meeting invitations through a separate channel and avoid downloading fixes from links presented during calls. [1] [2] [3]
US says theft finances the North Korean state
The U.S. government alleges that proceeds from North Korean cryptocurrency theft support the regime and prohibited weapons programs. North Korea has repeatedly rejected Western accusations about state-backed cybercrime. No individual defendant was identified in Thursday’s coordinated announcement. The immediate legal work will focus on forfeiture of the restrained assets, examination of seized servers and notification of victims. Investigators also will try to distinguish funds from the Binance theft from assets connected to other activity before any court orders a final transfer. [1] [2] [3]
Recovery and attribution are separate questions
A seizure warrant allows the government to take control of specifically identified assets on a showing of probable cause; it does not by itself produce a criminal conviction or prove every attribution claim. Blockchain records can trace transfers publicly, while linking a wallet to a state-directed actor generally requires exchange records, infrastructure analysis and intelligence from multiple investigations. Victims may later seek return of forfeited funds through a formal claims process. The action also illustrates the limits of recovery: stolen cryptocurrency can be split, swapped or routed through services beyond immediate reach. Officials urged companies to strengthen access controls and treat convincing video or voice contacts as potentially manipulated. [1] [2] [3]
Sources & further reading
- Justice Department Announces Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency ↗U.S. Department of Justice · 2026-11-12 · Primary source
- FBI says US has seized $1.2 billion worth of cryptocurrency stolen from Binance ↗Associated Press · 2026-11-13
- North Korean hackers steal more than $400 million using video images, FBI says ↗Reuters · 2026-11-12
Reader comments.
Keep it respectful and relevant to the report. No personal information, harassment or unsupported accusations. Comments are readers’ views.
Loading your sign-in status…