DOJ announces court-authorized seizure and restraint of over 1.2 billion dollars from the Binance hack and disruption of the Fac

📅 12 November 2026 • DOJ, The Block, CoinDesk

DOJ announces court-authorized seizure and restraint of over 1.2 billion dollars from the Binance hack and disruption of the FaceStealer deepfake infrastructure

According to DOJ press release 26-1356 issued on November 12, 2026, the department obtained court authorization for the seizure and restraint of more than 1.2 billion dollars in cryptocurrency stolen from Binance in the October 29 hack. The wording matters for compliance teams — this is a court-authorized seizure and restraint within a broader freeze, not a completed forfeiture, and forfeiture proceedings remain ongoing.

DOJ said the Binance theft exceeded 6 billion dollars and attributed it to North Korean military hackers the FBI calls TraderTraitor. Binance estimated its loss at about 6.3 billion dollars, per The Block. The department also said collective U.S. government and private sector efforts have so far frozen more than 2.7 billion dollars of the stolen funds — the 1.2 billion dollar authorization is part of that total, and on the private side Tether and Circle froze funds immediately after the October 29 breach, Bloomberg Law reported.

In a separate action in the Central District of California with FBI Los Angeles, DOJ announced the seizure of cloud-based infrastructure used in the FaceStealer social-engineering campaign, which per the release stole more than 400 million dollars over roughly 18 months. Mechanics per DOJ and the FBI IC3 report — victims are lured into video calls through stolen accounts, prerecorded videos of known contacts or AI deepfakes of well-known figures are played, and a fake technical error prompt installs malware, with theft sometimes occurring months to more than a year after compromise. Pursuant to a federal warrant the FBI seized over 900 webcam videos of victims, per DOJ. The department added that the campaign increasingly targets open-source software developers, apparently to enable supply-chain attacks.

DOJ listed aliases for the same actors, including Sapphire Sleet, BlueNoroff and Stardust Chollima. "We have consistently met them head on, as we did here seizing more than 1.2 billion dollars of their stolen assets," U.S. Attorney Jeanine Ferris Pirro said in the release. DOJ added that tracing continues as stolen funds move through bridges and mixers.

IMPACT
VASPs and exchanges face sustained law-enforcement disruption of stolen funds and are expected to keep screening and freezing flows tied to listed addresses — the FBI Cyber Alert chain continues. Firms and especially open-source developers face deepfake video-call social engineering — verify callers out-of-band, treat technical error prompts as red flags, report incidents to IC3. Compliance teams gain a live case study for red-flag training. The public-private freeze cooperation around Tether and Circle shows the response playbook in action.

Sources: justice.gov, coindesk.com, wdbo.com, news.bloomberglaw.com, therecord.media, decrypt.co, ic3.gov