Binance Hack Seizure: DOJ Moves to Take $1.2B From North Korea
DOJ Wins Court Approval in Binance Hack Seizure Move
Crypto news today centers on the U.S. Justice Department. On November 12, 2026, it said a court authorized it to seize or restrain more than $1.2 billion in assets from the October hack of Binance. This Binance hack seizure targets money stolen by North Korean government-linked hackers.
The DOJ press release is the primary source for this update. It also covers a separate action against a North Korean scam called FaceStealer.
How the Hack Unfolded and Who Is Held Responsible
On or about October 29, 2026, hackers stole more than $6 billion in virtual assets from the world’s largest crypto exchange. Many describe it as the biggest crypto theft on record. The FBI blames TraderTraitor, which it calls North Korean military hackers. Blockchain analysis firms independently tied the on-chain activity to the same actors.
Binance covered user losses from its own reserves. Around October 31, the FBI, Secret Service, and IRS-CI issued a cyber alert. It listed hundreds of related addresses, mostly on Ethereum, and urged service providers and DeFi platforms to block them.
The Block also summarized the news on X.
From $2.7B Frozen to $1.2B Seizure: What the Numbers Mean
U.S. agencies worked with crypto service providers and froze more than $2.7 billion of the stolen funds. A court then authorized the DOJ to seize or restrain more than $1.2 billion of that amount.
Step | Amount |
Stolen | $6B+ |
Frozen | $2.7B+ |
Court authorization to seize or restrain | $1.2B+ |
The Binance hack seizure is a legal step toward forfeiture, where ownership passes to the government. It does not mean every token is already in U.S. hands. Investigators are still tracing funds through bridges, mixers, and exchanges, so totals may change in later crypto news updates.
FaceStealer Scheme Disrupted in a Separate DOJ Action
The same announcement covers FaceStealer, a social-engineering campaign tied to North Korean actors also tracked as Sapphire Sleet and BlueNoroff. The DOJ says the campaign stole more than $400 million in crypto over the prior 18 months.
Under a federal warrant, the FBI seized cloud infrastructure and more than 900 webcam videos of victims. The FBI FaceStealer page has details.
Officials say the scam works like this:
Attackers record a victim’s webcam during a call and hijack their messaging accounts.
They invite the victim’s contacts to fake Zoom, Teams, or Meet calls on lookalike domains.
A replayed video or deepfake shows a familiar face.
A fake audio error leads the victim to a “fix” that installs malware.
The bureau warns the scheme can fool experienced users and now targets open-source software maintainers. Its FLASH report lists mechanics and recommendations.
What This Update Means for Crypto Security Teams
The case shows a Binance hack seizure depends on exchanges, token issuers, and agencies moving fast. Officials note that much of the liquidity sits with private providers, such as stablecoin issuers that can freeze funds.
Treat unexpected meeting links and “fix” scripts as red flags. The FaceStealer resource hub offers guidance.
Disclaimer: This article is for educational and informational purposes only and should not be considered financial or investment advice. Always conduct your own research before making investment decisions.
