DOJ Moves to Seize $1.2B From Binance Hack and Shuts Down FaceStealer

The US Department of Justice has court approval to seize or restrain more than $1.2 billion of the $6.3 billion stolen from Binance on Oct. 29. At the same time, the agency exposed a separate North Korean scheme called FaceStealer, which took more than $400 million from people in the crypto industry over 18 months. Both stories lead to the same hacking network, so here is what happened.

What exactly did the court allow?

The approval covers part of the assets that authorities and private-sector partners have already reached. They have frozen more than $2.7 billion since the incident began, and more than $1.2 billion of that now has a court basis for seizure or restraint. By our math, roughly $3.6 billion of the stolen funds is still not frozen. Investigators keep searching.

In a cyber alert, the FBI named North Korea's TraderTraitor group as the author of the breach. Kim Yo Jong, the sister of North Korea's leader, denied Pyongyang's involvement. Binance covered the affected assets from its own funds, and a new proof-of-reserves snapshot (a report showing whether an exchange holds enough assets to cover every customer balance) confirmed backing of at least one to one, according to its post on X.

The difference between "frozen" and "seized" matters. A freeze stops funds from moving at specific addresses, for example when an exchange or a stablecoin issuer blocks tokens. A court basis for seizure gives the state the right to take those assets for good, but only once they are truly under control.

How does the FaceStealer scheme work?

To see the point, start with trust. The hackers do not break code, they rely on the habit of believing a familiar face on screen. According to the DOJ, they secretly recorded video of earlier victims and built deepfakes (AI-generated video or voice that imitates a real person) of prominent figures in the crypto world.

• the victim is invited to a video conversation where someone familiar or famous appears.
• The screen shows recorded footage or a deepfake that looks and sounds convincing.
• During the chat, a supposed technical problem comes up, with a quick fix on offer.
• The fix turns out to be malware, and the hackers gain access to the device.

The targets were people working in crypto and Web3. Increasingly, the hackers switched to open-source developers and maintainers (the people who look after popular software projects). Their devices and repository accounts open a path into other people's software.

That explains why victims often missed the swap. The voice, the expressions and even the manner of speaking matched what they had seen before, and the request looked routine, as in something is broken and we will fix it now. The routine tone is what makes the scheme dangerous.

What did the FBI take from the hackers?

The DOJ seized the cloud infrastructure that held the campaign together. Under a federal warrant, the bureau also obtained more than 900 webcam videos of victims. The hackers recorded them during calls and then reused them as raw material for new fakes, so footage from one victim helped fool the next.

The FBI published a public advisory on protection and on what to do after a compromise. The group behind the scheme goes by Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. Seven names, and one network, according to the DOJ.

In November 2025 the department had already targeted about $15 million tied to APT38. Back then it was millions. Now it is a billion.

Why does a seizure not mean a refund yet?

The accounts of the DOJ announcement we have seen say nothing about who gets the seized funds back and when. For now there are three different numbers. $6.3 billion was stolen, over $2.7 billion is frozen, and over $1.2 billion has a court basis for seizure. They should not be mixed up.

For Binance customers the story is already closed, since the exchange said it covered the losses from its own funds. The company said earlier that the attackers got in through fake job interviews and an internal AI tool. So there, too, a person was deceived, not a protocol broken.

What users should do and what the market may do

The market barely reacts to this news. Bitcoin trades near $69,400 after falling almost 5% in a day, and CoinDesk and Cointelegraph point to hot US inflation and Fed rate bets as the pressure. Ethereum sits around $1,960. The seizure changes the security picture for the industry, not the price.

For Ukrainian users who buy and sell USDT through exchanges and P2P, there is no direct effect, and exchanger rates have not moved on this news. Still, the rule of verifying a person outside the call applies to anyone who does crypto business remotely.

If someone on a video call asks you to install something, stop and check the person through another channel. A familiar face on screen is not proof. Anyone who works with wallets or code should read the FBI guidance.