US Gets Court Backing to Seize $1.2 Billion Tied to North Korea's Binance Theft

By Coinvote

Published November 13, 2026 - 07:22 UTC | 5 mins read

US Gets Court Backing to Seize $1.2 Billion Tied to North Korea's Binance Theft

The Justice Department says a court has authorized it to seize or restrain more than $1.2 billion taken in the October Binance theft attributed to North Korea. Officials also disclosed the takedown of infrastructure behind FaceStealer, a deepfake video-call scheme linked to more than $400 million in thefts.

A court order moves frozen Binance funds toward forfeiture

The U.S. Department of Justice said on Thursday that a court has given it authority to either seize or restrain over $1.2 billion of the crypto taken from Binance. Bitcoin Magazine reported that the sum is part of a wider freeze of more than $2.7 billion, which officials say stopped about half of the October exchange heist.

The department attributes the theft to North Korean military operatives that the FBI tracks as TraderTraitor. According to Bitcoin Magazine, the attack took place on or about Oct. 29. The Block summarized the news as a court approval to seize $1.2 billion and a separate takedown of the FaceStealer deepfake scam.

Assistant Attorney General A. Tysen Duva said authorities were able to halt about half of the breach by freezing assets before they moved beyond reach. The court papers were not published with the announcement, so the exact scope of the orders is not yet public.

Freezing, seizing and covering losses are three different things

The $1.2 billion is not newly recovered money, according to Bitcoin Magazine. Bitcoin Magazine reported that the sum is drawn from the roughly $2.85 billion that Binance said on Nov. 3 had been frozen or intercepted. Until now, those tokens had been held in place at the token issuers. With the court's authorization, the government can now move toward forfeiture, meaning a formal transfer of ownership to the state.

Binance's compensation of users runs on a separate track. The exchange said it completed coverage of the affected assets by replacing tokens from company funds. The money for the replacement came from three places: the Secure Asset Fund for Users, part of the insurance fund tied to its futures business, and Binance's own treasury. Bitcoin Magazine put that coverage at $6.34 billion, slightly above the more than $6 billion the DOJ cites for the theft itself.

The distinction matters to holders. Users were made whole by the exchange, not by clawed-back coins. Any assets that eventually pass through forfeiture would be handled by the government's process, not by Binance's coverage.

The numbers in the announcement

Several figures appear across the announcements, and they measure different things.

More than 900 webcam videos of FaceStealer victims were seized under a federal warrant, according to Bitcoin Magazine.

FaceStealer turns a routine meeting invite into a malware delivery

Alongside the Binance action, federal prosecutors in the Central District of California and the FBI announced they had seized cloud infrastructure behind a social engineering campaign called FaceStealer. Bitcoin Magazine reported that the FBI ties it to North Korean hackers known as APT38 and BlueNoroff.

The method is a fake video call. Targets receive meeting invitations from accounts stolen from earlier victims. After a target joins, the attackers play either a prerecorded webcam clip of an acquaintance or a deepfake of a prominent crypto figure. They then stage a technical error and send a supposed fix that installs malware.

An FBI FLASH report cited by Bitcoin Magazine says the calls run on imposter versions of Zoom, Microsoft Teams and Google Meet. Invitations often travel through hijacked Telegram, LinkedIn, Slack or Discord accounts. According to the report, some thefts happened from several months to over a year after the initial compromise, because the hackers waited while wallet balances increased. The FBI also said the scheme has been used against people who maintain open-source software, which the bureau described as a step that appears calculated to enable supply-chain attacks.

Where the outlets agree and where they differ

Bitcoin Magazine carries the full account of the announcements. CoinDesk, The Block and The Defiant are represented here only by their headlines and summaries, which support a narrower set of claims.

CoinDesk's headline says the DOJ is targeting $1.2 billion in stolen crypto, and The Block reports court approval to seize that sum. Bitcoin Magazine describes the authority as covering seizure or restraint.

All three outlets put FaceStealer's losses at about $400 million. CoinDesk says as much as that amount, while The Defiant and Bitcoin Magazine report more than $400 million over 18 months.

The Defiant's summary frames the DOJ action as a disruption of the fake-call scheme and does not mention the Binance seizure.

What exchanges, teams and holders can check

The FBI's Oct. 31 Cyber Alert called on virtual asset service providers to refuse transactions that involve, or originate from, addresses the hackers are using. The alert added that most of the stolen assets were observed being swapped into ether. The source does not say whether the alert publishes the addresses themselves.

For individuals and project teams, the FaceStealer description points to concrete habits. Unexpected meeting invitations from known contacts deserve verification through a separate channel. A request to install a fix during a call is a warning sign. The FBI has set up a hub page for the campaign with further detail.

Open questions to watch

The DOJ said TraderTraitor actors continue to move stolen assets via bridges, mixers and exchanges, while its efforts to trace, seize and forfeit them are ongoing. The department did not specify what share of the $2.7 billion freeze, or of the $1.2 billion covered by court authority, consists of bitcoin.

Several points remain open. It is unclear how quickly forfeiture proceedings will follow and whether the remaining frozen funds will receive similar orders. It is also unclear how the token issuers that hold the frozen assets will respond. The Binance recovery effort is being run by the FBI's Los Angeles Field Office with the Secret Service and IRS Criminal Investigation, and further filings could clarify these points.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$69,074	-6.0%	-8.7%	$1.39 trillion
Ethereum (ETH)	$1,943	-5.1%	-12.8%	$237.25 billion

CoinGecko data as of 2026-11-13 (UTC).

FAQ

How much of the Binance theft has the DOJ moved to seize?

A court has authorized the DOJ to seize or restrain over $1.2 billion, part of a larger joint freeze.

Have Binance users lost money in the hack?

Binance said it completed coverage of the affected assets, so users were made whole. That is separate from the DOJ's effort to seize stolen funds.

What is the FaceStealer scheme?

FaceStealer is a social engineering campaign the FBI attributes to North Korean hackers. It uses fake video calls to deliver malware disguised as a fix.