SKN | U.S. DOJ Targets $1.2 Billion in North Korean Crypto Theft From Binance and Disrupts FaceStealer Network

Key Points:

• The U.S. Department of Justice obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance in an attack attributed to North Korean hackers.
• Government agencies and private-sector partners have frozen more than $2.7 billion of the stolen assets, with investigations into additional funds still underway.
• Authorities separately disrupted the FaceStealer operation, a North Korean social-engineering campaign linked to more than $400 million in cryptocurrency theft over 18 months.

U.S. authorities are intensifying efforts to disrupt North Korea’s cryptocurrency theft operations, securing court authorization to seize or restrain more than $1.2 billion stolen from Binance while dismantling infrastructure associated with a separate cybercrime campaign. The coordinated actions highlight the growing intersection between digital-asset security, international sanctions enforcement and national security. For cryptocurrency markets, the developments demonstrate both the scale of state-linked cybercrime and the importance of cooperation between exchanges, blockchain companies and law enforcement agencies.

DOJ Targets More Than $1.2 Billion From Binance Hack

The Department of Justice announced that it had obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance. The assets form part of a much larger attack attributed by the FBI to North Korean military hackers operating under the name TraderTraitor.

The theft occurred around October 29, 2026, with the FBI identifying more than $6 billion in stolen virtual assets. Binance previously estimated its losses at approximately $6.3 billion. Since the incident, government agencies and private-sector partners have frozen more than $2.7 billion through coordinated efforts involving cryptocurrency service providers.

The distinction between frozen assets and court-authorized seizures is important. The $1.2 billion covered by the court authorization is part of the $2.7 billion already frozen, not an additional recovery. Authorities are continuing to trace the remaining funds as investigators monitor transactions moving through cryptocurrency bridges, mixers and exchanges.

FaceStealer Operation Exposes a Separate $400 Million Threat

Alongside the Binance-related action, the DOJ announced the disruption of cloud infrastructure used in a separate North Korean campaign identified by the FBI as FaceStealer. The operation has been linked to more than $400 million in cryptocurrency theft over 18 months.

The campaign relied on social engineering rather than exclusively targeting blockchain infrastructure. Hackers used compromised communication accounts to send convincing invitations to video meetings, often impersonating people already known to their targets. During these calls, attackers played prerecorded footage or artificial-intelligence-generated deepfakes to create the appearance of legitimate participants.

Victims were then presented with fabricated technical problems and instructed to install software or follow links supposedly needed to restore audio or video functionality. These actions could introduce malware capable of stealing cryptocurrency, capturing credentials and accessing other systems. The FBI also seized more than 900 webcam videos associated with victims.

Cybercrime Threatens the Wider Crypto and Software Ecosystem

FaceStealer’s implications extend beyond individual cryptocurrency holders. Investigators said North Korean actors increasingly targeted developers and maintainers of open-source software, potentially seeking access to software repositories and supply chains used by other organizations.

Compromising a developer’s account can create risks that extend across multiple applications and businesses relying on the affected software. This makes the campaign particularly relevant to crypto exchanges, wallet providers, infrastructure operators and decentralized finance platforms that depend on interconnected software systems.

The two operations also involve distinct North Korean-linked activity. The FBI attributed the Binance theft to TraderTraitor, while the FaceStealer campaign has been associated with other identified North Korean hacking groups. Authorities have not established that FaceStealer was used to execute the Binance breach.

Asset Recovery and Compliance Become Critical Priorities

The DOJ’s actions reinforce the importance of transaction monitoring and rapid cooperation across the digital-asset industry. The FBI has urged virtual-asset service providers, decentralized finance platforms, blockchain infrastructure operators and exchanges to block transactions involving identified laundering addresses.

The next stage will depend on whether investigators can trace additional stolen assets, secure further court orders and establish procedures for eventual forfeiture and recovery. For institutional participants, the episode underscores that cryptocurrency security extends beyond custody technology: counterparty screening, employee cybersecurity, software supply-chain controls and incident-response coordination are equally important. The scale of the Binance theft and the separate FaceStealer campaign demonstrate that protecting digital assets increasingly requires a coordinated response across the entire financial and technology ecosystem.