Washington is hitting back at Pyongyang’s crypto war chest. The U.S. Department of Justice has obtained court approval to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, the largest legal strike yet against the record-breaking October 29 heist that the FBI blames on North Korea’s military-linked hackers.
The move, announced Thursday, November 12, came alongside a second blow: federal agents took down cloud infrastructure behind “FaceStealer,” a North Korean campaign that lures victims into fake video calls, sometimes staged with AI-generated deepfakes, and has drained more than $400 million in crypto over the past 18 months.
Together, the actions mark one of Washington’s most aggressive efforts yet to cut off the stolen crypto that officials say funds the Kim regime and its weapons programs.
A $1.2 billion slice of a $2.7 billion freeze
The seizure order is carved out of a much larger pool. Working together, U.S. authorities and private-sector partners have frozen more than $2.7 billion of the roughly $6.3 billion taken from Binance, the DOJ said. The $1.2 billion now under court order is the portion the government has formally moved to take control of.
The FBI attributed the theft to “TraderTraitor,” a North Korean military-linked hacking operation.
“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, principal deputy assistant attorney general for national security. “Today’s announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime. The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.“
Assistant Attorney General Tysen Duva credited the department’s Criminal Division, its liaison to the digital asset industry, with moving fast enough to halt about half of the breach.
DOJ Moves to Seize $1.2 Billion From North Korea’s $6.3 Billion Binance Hack
Billions still in motion
Still, the court order covers less than a fifth of the haul. Investigators are tracing funds through blockchain bridges, mixers and exchanges in hopes of freezing more, the DOJ said.
On-chain sleuths offer a picture of how far the laundering has progressed. Analytics account Onchain Lens, citing Arkham Intelligence data, put the total stolen at about $6.34 billion earlier this week. By its count, roughly $2.85 billion is still accessible to the attackers, while about $891 million may already have been moved or laundered.
The hackers have recently pushed funds through the cross-chain protocols THORChain and Chainflip, a familiar North Korean tactic for hopping assets between blockchains faster than defenders can react. Blockchain analytics firm Elliptic tracked about 1,650 bitcoin landing in fresh addresses by November 6, converted from other stolen assets, with some later reaching the Tornado Cash mixer.
The FBI, Secret Service and IRS Criminal Investigation have urged crypto providers to block laundering-linked addresses. Onchain Lens has questioned whether the hackers could move another $1 billion before THORChain and Chainflip restrict the linked wallets.
FaceStealer: the con on the other side of the camera
If the Binance hack shows the scale of North Korea’s ambitions, FaceStealer shows their ingenuity. Federal agents seized the campaign’s cloud infrastructure; the FBI says it has netted more than $400 million in 18 months.
The scheme weaponizes the everyday video call. Using hijacked accounts, hackers invite targets to fake Zoom or Microsoft Teams meetings, where a familiar face appears: footage secretly recorded from earlier victims or, increasingly, an AI deepfake.
Then comes the trap. The attackers claim a technical glitch and ask the victim to install software or run a command to fix it. That “fix” installs malware that can empty crypto wallets and open doors into other systems. In some cases, the theft and takeover of communication accounts came months, even more than a year, after a computer was first compromised.
“It exploits our trust in ubiquitous video conference platforms and valued personal relationships,” said Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office. “If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough.“
The FBI said it seized more than 900 webcam videos of FaceStealer victims and has issued guidance for those affected. Most worrying to investigators, the hackers have used stolen contacts to target developers who maintain widely used open-source software. Compromising a single maintainer could hand attackers a path into countless downstream systems, turning one fooled engineer into a supply-chain breach.
The North Korean “FaceStealer” Exploit Cycle (Source: FBI)
What it means for Binance users, and for Pyongyang
For Binance customers, the government’s seizure will not change their balances. The exchange earlier put its losses at about $6.3 billion and set aside $6.34 billion of its own treasury and insurance funds to cover them. On Thursday, Binance said it had completed coverage of all affected assets and published a new proof-of-reserves snapshot. Any money the U.S. eventually forfeits would therefore not flow back into user accounts.
The bigger stakes are geopolitical. Every frozen dollar is one that cannot fund missiles, yet billions more are still moving through a laundering pipeline built for speed.
This week showed the fight now runs on two fronts: chasing stolen coins across chains, and dismantling the social-engineering machinery behind the next heist. Washington scored wins on both. Whether it can keep pace with an adversary this fast is the open question.
