DOJ moves to seize $1.2B from Binance hack, disrupts FaceStealer scam

73Importance
updatingStatus
5News media
Published
Updated

The Justice Department has court authorization to seize or restrain more than $1.2 billion in cryptocurrency tied to the Binance hack, while federal agents also described a separate FaceStealer operation that used stolen webcam footage in video calls. The wider case now includes more than $2.7 billion frozen, with North Korea-linked theft and social engineering both appearing in the same enforcement push.

Key claims & sources

✓
Authorities had already frozen more than $2.7 billion in assets linked to the Binance theft.
✓
The Justice Department obtained court authorization on Thursday to seize or restrain more than $1.2 billion in cryptocurrency tied to the Binance hack.
✓
Federal agents separately described an operation against FaceStealer, a scheme that used stolen webcam footage to impersonate trusted people on video calls.
✓
The Binance-linked theft was attributed to North Korea’s TraderTraitor operation, and tracing continued across bridges, mixers and exchanges.
✓
The Justice Department also said the stolen Binance crypto was taken in October.
✓
FaceStealer stole more than $400 million over 18 months.

What it means

Exchanges and custodians holding any of the $1.2 billion now face binding freeze orders, meaning wallets can be locked without the holder's cooperation once addresses are flagged. Victims of the original Binance theft gain a path toward eventual restitution, though forfeiture proceedings take years to resolve. North Korea's operators lose access to funds they had hoped to launder through mixers, and investigators get a template for chasing the remaining sums still unaccounted for within the $2.7 billion frozen so far.

The case undercuts the assumption that mixers and cross-chain bridges guarantee anonymity: blockchain's public ledger let investigators trace stolen funds across multiple hops well after the theft. That transparency cuts both ways, since the same traceability that helps seize criminal proceeds also exposes ordinary users' transaction histories. FaceStealer's use of stolen webcam footage shows state-linked actors now blend crypto theft with old-fashioned social engineering, a combination regulators are still learning to police.

The $1.2 billion authorization opens formal forfeiture proceedings in US courts, where claimants can contest ownership before any final disposition of funds. Watch whether the remaining gap between the $2.7 billion frozen and the broader North Korean theft total, cited elsewhere at over $6 billion, narrows through further court filings. Additional FBI action against FaceStealer's cloud infrastructure, which supported over $400 million in losses over 18 months, may also yield fresh indictments.

Market reaction i

BitcoinBTC it is the asset of the company or protocol in the event

Bitcoin rose 0.6% in the 4 hours after the first headline, after falling 0.1% in the 2 hours before.

$68,577 price at the headline
-0.1% 2 h before
+0.6% 4 h after
+0.4% 12 h after
First headline

47 prices, one every 30 minutes

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Nov 13 09:27
Cointelegraph scoop
Breaks the event: $2.7B
+22 min
Nov 13 09:49
+1 h 19 m
Nov 13 10:45
Unchained context
Its angle: immediately, sabbatella, newsletter; with quotes
+3 h 30 m
Nov 13 12:57
Crypto Economy echo
No new facts: increasingly, cyberattacks, enforcement; with quotes
+7 h 37 m
Nov 13 17:04
Bitcoinist echo
No new facts: significant, cybercrime, disruption; with quotes
+9 h 19 m
Nov 13 18:46
The Crypto Guardian echo
No new facts: designation, identifying, coordinated; with quotes
+10 h 8 m
Nov 13 19:35
The Coin Republic echo
No new facts: targeting, insights, identify; with quotes

Has this happened before?

WhenWhat happenedFigure
35 days ago DOJ Seeks $61.2 Million in Crypto Tied to Iranian Oil Sales event 2 actors in common · 4 news media
4 days ago Binance Shuts Down Transfers Involving MEXC and Its Affiliates event 1 actors in common · 4 news media
7 days ago Treasury cuts off MEXC Global over alleged $16 billion in transactions linked to Iran, North Korea and Russia event 1 actors in common · 18 news media
8 days ago U.S. Justice Department assembles force to shield against foreign AI threats event 1 actors in common · 3 news media
15 days ago India Names Binance and Bybit Among Foreign Platforms in $585M Crypto Remittance Probe event 1 actors in common · 4 news media