DOJ moves to seize $1.2B from Binance hack, disrupts FaceStealer scam
- Published
- Updated
The Justice Department has court authorization to seize or restrain more than $1.2 billion in cryptocurrency tied to the Binance hack, while federal agents also described a separate FaceStealer operation that used stolen webcam footage in video calls. The wider case now includes more than $2.7 billion frozen, with North Korea-linked theft and social engineering both appearing in the same enforcement push.
Key claims & sources
What it means
Exchanges and custodians holding any of the $1.2 billion now face binding freeze orders, meaning wallets can be locked without the holder's cooperation once addresses are flagged. Victims of the original Binance theft gain a path toward eventual restitution, though forfeiture proceedings take years to resolve. North Korea's operators lose access to funds they had hoped to launder through mixers, and investigators get a template for chasing the remaining sums still unaccounted for within the $2.7 billion frozen so far.
The case undercuts the assumption that mixers and cross-chain bridges guarantee anonymity: blockchain's public ledger let investigators trace stolen funds across multiple hops well after the theft. That transparency cuts both ways, since the same traceability that helps seize criminal proceeds also exposes ordinary users' transaction histories. FaceStealer's use of stolen webcam footage shows state-linked actors now blend crypto theft with old-fashioned social engineering, a combination regulators are still learning to police.
The $1.2 billion authorization opens formal forfeiture proceedings in US courts, where claimants can contest ownership before any final disposition of funds. Watch whether the remaining gap between the $2.7 billion frozen and the broader North Korean theft total, cited elsewhere at over $6 billion, narrows through further court filings. Additional FBI action against FaceStealer's cloud infrastructure, which supported over $400 million in losses over 18 months, may also yield fresh indictments.
Market reaction i
Bitcoin rose 0.6% in the 4 hours after the first headline, after falling 0.1% in the 2 hours before.
47 prices, one every 30 minutes
Coverage timeline
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
Has this happened before?
| When | What happened | Figure |
|---|---|---|
| 35 days ago | DOJ Seeks $61.2 Million in Crypto Tied to Iranian Oil Sales event | 2 actors in common · 4 news media |
| 4 days ago | Binance Shuts Down Transfers Involving MEXC and Its Affiliates event | 1 actors in common · 4 news media |
| 7 days ago | Treasury cuts off MEXC Global over alleged $16 billion in transactions linked to Iran, North Korea and Russia event | 1 actors in common · 18 news media |
| 8 days ago | U.S. Justice Department assembles force to shield against foreign AI threats event | 1 actors in common · 3 news media |
| 15 days ago | India Names Binance and Bybit Among Foreign Platforms in $585M Crypto Remittance Probe event | 1 actors in common · 4 news media |