doj binance seizure: Court OKs $1.2B Grab, FaceStealer Deepfake Ring Hit
The doj binance seizure: the US Justice Department says it has court authority to seize over $1.2B tied to the Oct 29 Binance hack, and it took down infrastructure behind the "FaceStealer" deepfake scheme.
- The DOJ says it can now seize or restrain over $1.2 billion of the roughly $6.4 billion stolen from Binance, out of more than $2.7 billion frozen so far.
- The FBI attributes the Binance theft to TraderTraitor, a North Korean military-linked hacking group.
- A separate operation seized cloud infrastructure and more than 900 webcam videos from FaceStealer, which the FBI says stole over $400 million in 18 months.
in this block
The doj binance seizure is the biggest recovery step yet after the October 29 Binance hack. On November 12, the US Justice Department said it has court authorization to seize or restrain more than $1.2 billion tied to the theft, and in the same announcement it revealed it took down infrastructure behind a North Korean deepfake video-call scheme it calls "FaceStealer."
What actually happened
The Justice Department bundled two North Korea actions into one announcement. The headline number is the Binance piece. According to CoinDesk's report on the DOJ action, the department obtained court authority to seize more than $1.2 billion that had already been frozen after the attack. That sits inside a wider pool of more than $2.7 billion frozen by authorities and private companies.
Investigators are still tracing funds through bridges, mixers and exchanges. Decrypt noted that the attackers have been laundering at speed, spinning up a new wallet roughly every 25 seconds. North Korea has denied involvement and called the FBI's attribution a political provocation.
M. Scott Proctor, a senior official in the DOJ's National Security Division, said North Korea "bankrolls its rogue regime and illicit weapons program through cryptocurrency theft" and promised to use "every tool" to seize and return the gains.
Where this fits in the hack timeline
We covered the original theft in binance 6.3b hack and the FBI's attribution in fbi tradertraitor binance. Some outlets put the total at $6.3 billion and some at $6.4 billion; the difference comes down to pricing at different times. Either way, a court-approved seizure of more than $1.2 billion is a meaningful slice. It is not money back in users' hands yet, and the DOJ did not give a timeline for returning funds.
The FaceStealer side of the doj binance seizure news
The second operation is arguably more useful for ordinary crypto users, because it explains how people get hacked. The FBI says FaceStealer works like this:
- Hackers take over accounts of previous victims and use them to invite new targets to video meetings that look like Zoom or Microsoft Teams.
- They play secretly recorded webcam footage of trusted contacts, and increasingly AI-generated deepfakes of well-known industry figures, to make the call look real.
- Mid-call, they fake a technical problem, such as "we can't hear you," and send a link or command to "fix" it.
- That fix installs malware that can drain wallets and open access to other systems, sometimes long before the attackers actually strike.
Federal agents seized the cloud infrastructure behind the scheme and more than 900 webcam recordings of victims. Decrypt reported that the DOJ linked the operation to groups tracked as Sapphire Sleet, BlueNoroff and APT38, and warned they are increasingly going after open-source developers to set up supply-chain attacks.
The key lesson from FaceStealer: a familiar face on a video call is no longer proof of who you are talking to.
Why it matters for the market
North Korean theft has become a structural risk in crypto. The Binance hack drove withdrawals, freezes and weeks of headlines. A large court-approved seizure helps restore some confidence that stolen funds can be trapped. But more than half of the stolen amount is still not frozen, by the DOJ's own numbers.
It also fits a broader pattern where stablecoin issuers and analytics firms act faster. Cointelegraph, citing Crystal Intelligence, reported that Tether froze the remaining USDT in two wallets linked to the theft, and analytics firms have been tracing flows since. Our elliptic binance freeze piece looked at that early freeze work.
What to do as a reader
The doj binance seizure does not change much for individual users yet, but the FaceStealer details are directly useful:
- Never install software mid-call. If someone on a video meeting asks you to run a "fix," hang up and verify through another channel.
- Verify the person, not the face. Confirm meeting invites by text or a known number, especially if they come from an account you have not heard from in a while.
- Separate devices. Keep wallets with meaningful funds off the laptop you use for random calls.
- Watch official channels. Any recovery process for Binance users will come from Binance or US authorities, not from DMs.
Nothing here is legal or financial advice.
Not financial advice. DYOR, ser.
