FBI Seizes 1.2 Billion Dollars in Crypto Stolen From Binance in Record North Korean Hack Crackdown

The United States government has struck back at North Korea's cryptocurrency theft machine. The Justice Department announced on Thursday, November 12, 2026, that it has won court approval to seize more than 1.2 billion dollars in cryptocurrency stolen from Binance, and that the FBI has disrupted a separate North Korean scam that stole more than 400 million dollars from ordinary crypto users.

The Binance theft, carried out on October 29, 2026, is the largest cryptocurrency heist in history. Hackers linked to North Korea's military stole more than 6 billion dollars in digital currency from the world's largest crypto exchange. The FBI says government agencies and private companies have now frozen more than 2.7 billion dollars of the stolen funds.

What Happened, In Short

The Justice Department announced on Thursday, November 12, 2026, that it has court authorization to seize or restrain more than 1.2 billion dollars in cryptocurrency stolen from Binance in the record October 29 hack. Hackers linked to North Korea stole more than 6 billion dollars from the exchange, the largest crypto theft ever recorded. In a separate action the same day, the FBI disrupted FaceStealer, a North Korean social engineering campaign that used fake video calls and stolen webcam footage to steal more than 400 million dollars over 18 months. More than 2.7 billion dollars of the Binance funds have now been frozen, and the FBI seized more than 900 webcam videos used in the FaceStealer scheme.

What the Justice Department Announced

The announcement came in a Justice Department press release published on November 12, 2026. It described two separate legal actions against North Korean cybercrime operations, both announced on the same day.

First, the department obtained court authorization to seize or restrain more than 1.2 billion dollars worth of cryptocurrency recently stolen from Binance. The department said collective efforts by the United States government and private sector partners have resulted in the freezing of more than 2.7 billion dollars of the stolen funds. The rest of the money is still being traced, and efforts to freeze, seize and forfeit it are ongoing.

Second, the FBI seized cloud infrastructure used in FaceStealer, a North Korean social engineering campaign, and obtained a court order to seize more than 900 webcam videos the hackers used to trick their victims.

"Today's announcement shows that America will fight back against that corrupt regime's effort to profit through cybercrime," said M. Scott Proctor, the principal deputy assistant attorney general for national security, in the department's statement.

The Record Binance Hack: What Was Stolen

The attack on Binance took place on or about October 29, 2026. Hackers targeted Binance wallets across 10 blockchain networks and stole an estimated 6.3 billion dollars in digital currency, according to Binance. Blockchain analytics firm Elliptic has tracked 6.43 billion dollars across more than 20,000 wallets.

The theft is the largest cryptocurrency heist on record. It surpassed the 1.5 billion dollar Bybit hack of February 2025, according to blockchain intelligence firm TRM Labs. The FBI has attributed the Binance attack to TraderTraitor, a North Korean hacking operation linked to the country's military.

Binance has pledged to cover customer losses from its own funds, so customers are not waiting on the seized money to be made whole. The Justice Department said it will seize and return the funds, but it has not said when or how the seized crypto would go back to Binance, and no forfeiture judgment has been announced. No individual has been named or charged for the October 29 theft in this release.

The department also warned that North Korea's operatives continue to launder the stolen assets through cryptocurrency bridges, mixers and exchanges, which is why the recovery effort is still running.

Read Also: DOJ Takes Over Megaspeed Chip-Smuggling Probe After Nvidia Intervened, NYT Reports | Microsoft 365 Outage: Outlook, Teams Down Worldwide

FaceStealer: How the Fake Video Call Scam Worked

FaceStealer is a separate North Korean operation from the Binance hack, run by state hackers also known as Sapphire Sleet and BlueNoroff. The FBI says it has stolen more than 400 million dollars in cryptocurrency over the past 18 months, mostly from individuals working at technology and cryptocurrency companies.

The scheme worked in stages. North Korean operatives used stolen webcam videos, mostly recorded footage of previous victims, and in some cases AI-generated deepfakes of well-known and influential people, to impersonate someone the target trusted during a video call. During the call, the operatives claimed a technical error was interfering with the conversation and persuaded the target to install software to fix it. The software delivered malware that stole cryptocurrency and took over the victim's machine.

In several reported cases, the hackers stole cryptocurrency and hijacked communication accounts several months to more than a year after the first compromise. They also accessed each new victim's contact lists, social media and communications apps, then used those contacts to target the victim's personal and professional network, turning each victim's webcam video into bait for the next one.

More recently, North Korea has begun targeting the maintainers of critical open-source software packages. The FBI's alert described the group's efforts to compromise a significant open-source JavaScript library that receives tens of millions of downloads per week. Through a video call with the project's maintainer that appeared to include one of the victim's trusted contacts, the hackers convinced the target to install malware that let them create malicious dependencies downloaded alongside legitimate library downloads.

The FBI published an alert about FaceStealer on November 12, 2026, laying out the multistage scheme and offering recommendations for avoiding it. The bureau also set up a dedicated FaceStealer information hub to help potential victims recognize the attack. It warned that it is aware of several other attempts by North Korean hackers to target software developers, maintainers and software libraries with significant download volume.

Why North Korea Steals Crypto

The twin law enforcement actions reflect the United States government's intense focus on stopping North Korea from using cyberattacks to evade sanctions and finance its weapons programs. Stolen cryptocurrency has become one of the regime's most important revenue sources, because it can be moved across borders and converted into cash outside the reach of traditional banking controls.

The Justice Department's crackdown follows a pattern. The FBI has attributed a series of major crypto thefts to North Korean state hackers in recent years, and the Binance theft is by far the largest. The department's statement made clear that the recovery effort is far from over: only about half of the stolen funds have been frozen so far, and the rest is still being laundered through bridges, mixers and exchanges.

For background on how the Justice Department has pursued other technology crime cases, read our report on the DOJ taking over the Megaspeed chip-smuggling probe, and our coverage of the global Microsoft 365 outage that disrupted workplaces around the world the same week.

What Happens Next

The Justice Department said efforts to trace, freeze, seize and forfeit the stolen virtual assets are ongoing. The 1.2 billion dollars now under a court order is only part of the 2.7 billion dollars frozen so far, and about 1.5 billion dollars is frozen but not yet under a court order. No timeline has been given for returning the funds to Binance.

The FBI's FaceStealer disruption removes infrastructure the hackers used, but the bureau's alert makes clear the threat continues. Anyone who receives an unexpected video call, especially one asking them to install software or fix a technical problem, should verify the caller's identity through a separate channel before clicking anything. To learn more about staying safe online, follow the FBI's published guidance on the FaceStealer scheme.

For the latest verified information, follow reports from the Justice Department, the FBI, CybersecurityDive and Bitdefender.

Frequently Asked Questions

How much crypto did the FBI seize from the Binance hack?

The Justice Department obtained court authorization to seize or restrain more than 1.2 billion dollars in cryptocurrency stolen from Binance. United States government and private sector efforts have frozen more than 2.7 billion dollars of the more than 6 billion dollars stolen in total.

How much was stolen from Binance in total?

Hackers stole an estimated 6.3 billion dollars in digital currency from Binance on or about October 29, 2026, according to Binance. Blockchain analytics firm Elliptic tracked 6.43 billion dollars across more than 20,000 wallets. It is the largest cryptocurrency theft on record.

Who does the FBI blame for the Binance hack?

The FBI attributes the theft to TraderTraitor, a North Korean hacking operation linked to the country's military. No individual has been named or charged for the October 29 theft in the Justice Department's November 12 announcement.

What is FaceStealer?

FaceStealer is a separate North Korean social engineering campaign that has stolen more than 400 million dollars in cryptocurrency over 18 months. It uses fake video calls with stolen webcam footage and AI deepfakes to impersonate trusted contacts, then tricks victims into installing malware. The FBI disrupted its infrastructure and seized more than 900 victim webcam videos on November 12, 2026.

Will Binance customers get their money back?

Binance pledged to cover customer losses from its own funds, so customers are not waiting on the seized crypto. The Justice Department says it will seize and return the funds to Binance, but it has not announced a timeline or a forfeiture judgment.

How can I protect myself from FaceStealer-style scams?

Never install software at the request of someone on an unexpected video call, even if the caller looks and sounds like someone you know. Verify the caller's identity through a separate channel first. The FBI has published an alert and a dedicated information hub with guidance on recognizing the scheme.

Related Posts: DOJ Takes Over Megaspeed Chip-Smuggling Probe After Nvidia Intervened, NYT Reports | Microsoft 365 Outage: Outlook, Teams Down Worldwide | Nvidia Board Opens Independent Investigation Into CEO Jensen Huang