DOJ moves to seize $1.2B from Binance hack, disrupts FaceStealer scam

The Binance theft in October drained roughly $6 billion in assets, which U.S. authorities attribute to North Korea's TraderTraitor hacking unit, part of the broader Lazarus apparatus tied to earlier heists at Ronin Bridge and Harmony's Horizon bridge. DOJ forfeiture actions against North Korean crypto proceeds are not new, but court authority covering $1.2 billion of this theft ranks among the largest recovery efforts the department has pursued.

With court authorization secured, the DOJ can now direct exchanges and custodians holding the traced $1.2 billion to freeze or surrender those specific wallets rather than wait for a conviction. Agents also dismantled cloud infrastructure behind the FaceStealer campaign, cutting off tools used to fake trusted faces on video calls. Crypto and Web3 firms must now verify identity through channels beyond a webcam feed before authorizing transfers.

FaceStealer's $400 million take over eighteen months, aimed squarely at crypto and Web3 workers, shows social engineering can rival exploit code as a theft vector. Seizing $1.2 billion of a $2.7 billion freeze against a reported $6 billion loss demonstrates forfeiture law can chase funds across mixers and bridges, yet leaves roughly half the stolen total beyond reach, a gap that undercuts any claim that blockchain tracing alone solves state-sponsored theft.

Watch the civil forfeiture complaint tied to this court order, which must specify which wallets and exchange accounts move from frozen to formally seized under U.S. asset forfeiture law. Also watch whether the gap between the $2.7 billion frozen and the funds stolen in October's hack narrows, and whether TraderTraitor resurfaces through new bridges once this batch of crypto is locked down.