DOJ Seizes $1.2B in Binance Hack, Disrupts FaceStealer Scam
The Justice Department won court approval to seize $1.2 billion stolen from Binance and shut down a deepfake scheme that stole $400 million in 18 months.
Image: Wikimedia Commons / Jack E. Boucher
WASHINGTON — The United States Department of Justice said on Thursday, November 12, that it has obtained court approval to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, the crypto exchange, in the largest crypto theft on record. It also said the Federal Bureau of Investigation seized the cloud servers behind a deepfake video-call scheme that stole more than $400 million from crypto workers over 18 months.
The theft took place on or about October 29, when hackers the FBI calls TraderTraitor took more than $6 billion in virtual assets from Binance in about 20 minutes, starting at 4:30 p.m. ET. Binance has put the loss at about $6.3 billion. The FBI has attributed the attack to members of North Korea’s military. Pyongyang has denied any role.
- Court orders cover more than $1.2 billion of the roughly $6.3 billion stolen — part of a wider freeze of more than $2.7 billion, not an additional recovery.
- The FBI seized cloud servers used in the FaceStealer scheme, which used secretly recorded webcam videos and AI deepfakes to plant malware.
- More than 900 webcam videos of victims were seized under a federal warrant.
- Binance covered the affected customer balances from company funds, so customers did not lose money.
How Much Crypto Was Stolen From Binance and How Much Has Been Recovered
The Justice Department said the United States government and private companies have frozen more than $2.7 billion of the stolen funds, about half of the total taken. The court orders cover more than $1.2 billion of that frozen total. The department stressed the $1.2 billion is not newly recovered money: it is the share of frozen assets courts have now authorised the government to seize or restrain while forfeiture proceedings move forward. The theft has weighed on crypto markets, with Bitcoin falling to a two-month low.
| Figure | Amount |
|---|---|
| Stolen from Binance | About $6.3 billion |
| Frozen so far | More than $2.7 billion |
| Under court seizure orders | More than $1.2 billion |
| Stolen by FaceStealer | More than $400 million |
| Victim videos seized | More than 900 |
How the FaceStealer Deepfake Video Call Scam Works
FaceStealer begins with a message from an account the victim trusts. Hackers working under names including Sapphire Sleet, BlueNoroff and APT38 hijack accounts on Telegram, LinkedIn, Slack and Discord, then invite crypto workers to a video meeting. On the call, the victim sees a familiar contact, played from secretly recorded webcam footage and enhanced with AI deepfakes. A supposed fix for a reported audio problem installs malware instead. The FBI said the scheme also targeted open-source developers, breaking into one developer’s computer to add malicious code to widely used software before the attack was stopped. It follows another large breach disclosed this month, in which attackers ran up about $740,000 in fraudulent AI charges.
What the $1.2 Billion Seizure Means for Binance Customers
Binance said on Thursday it has finished covering the affected customer balances from company funds. The orders do not return the money to the exchange: they let the government hold the frozen assets while it pursues forfeiture, which would transfer ownership to the United States. Crypto-linked stocks face fresh scrutiny from index providers. The department’s Criminal Division chief, A. Tysen Duva, said investigators froze the stolen assets “before they got beyond law enforcement reach,” halting “about half of this historic breach.”
Frequently Asked Questions
How much money was stolen in the Binance hack?
More than $6 billion was taken on October 29; Binance puts the loss at about $6.3 billion. The FBI attributes the attack to North Korean military hackers it calls TraderTraitor.
Is the $1.2 billion seized from Binance new money?
No. It is part of the more than $2.7 billion already frozen. The orders authorise the government to seize or restrain that share while forfeiture proceedings continue.
How does the FaceStealer deepfake scheme work?
Hackers hijack trusted accounts and invite crypto workers to video calls, playing secretly recorded webcam footage and AI deepfakes. A fake audio fix then installs malware. The FBI seized the scheme’s servers and more than 900 victim videos.
Did Binance customers lose money in the hack?
No. Binance said it covered the affected balances from company funds, completing that coverage on November 12.
The department has not said how much of the frozen assets is bitcoin. The FBI said it will keep publishing details as its investigation continues.
