US Department of Justice Cracks Down on North Korean Binance Hack Targeting $1.2B in Crypto

Nov 12, 2026, 5:55 p.m. EST

2 min read

Summary

The U.S. Justice Department spotlighted two ongoing operations to thwart North Korean hackers attempting to plunder digital assets, which features the confiscation of tech utilized to deceive victims in a video-conference plot.
The DOJ additionally announced it obtained judicial permission to confiscate upwards of $1.2 billion that was frozen following the late heist at Binance.

The United States Department of Justice announced it is actively taking control of infrastructure and assets tied to North Korea’s primary initiatives to siphon billions in digital currencies, featuring tools deployed in the “FaceStealer” thefts alongside an approved confiscation of $1.2 billion in cryptocurrency taken during the recent breach at Binance.

This authorized retrieval forms a segment of a wider campaign by American officials and commercial entities that has locked down more than $2.7 billion out of the over $6 billion lifted from Binance on Oct. 29. The FBI linked the breach to a hacking cell associated with the North Korean military called ‘TraderTraitor.’

Investigators are pursuing the tracked digital money across cross-chain bridges, mixers, and trading platforms as they endeavor to lock down and retrieve additional funds, according to the DOJ.

“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” stated M. Scott Proctor, principal deputy assistant attorney general for national security at the DOJ, in an official statement. “Today’s announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime. The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.”

In a distinct action, federal agents confiscated cloud infrastructure applied in a North Korean cyber assault known as FaceStealer, which the FBI reports has looted in excess of $400 million in digital assets over the prior 18 months.

The operation relies on counterfeit video conferences modeled after Microsoft Teams or Zoom to dupe individuals into downloading malicious programs. The cybercriminals masquerade as reliable peers by leveraging covertly recorded video streams from past targets alongside, with increasing frequency, artificial intelligence-powered deepfake recordings.

As soon as a target logs into the fake conference, the operators assert a technical malfunction exists and prompt the participant to download software or execute a command to resolve the issue. The provided steps instead download malware capable of draining crypto holdings while granting perpetrators entry into extra networks.

The FBI disclosed that it confiscated in excess of 900 webcam clips accumulated by the threat actors, who have likewise directed attacks toward developers managing popular open-source software libraries. The bureau cautioned that compromising a software creator could grant the bad actors entry.