DOJ Seizes $1.2B from Binance Hack, Disrupts FaceStealer Scam

Binance Hack Proceeds Frozen, FaceStealer Scam Nets Millions

U.S. authorities have secured court authorization to seize over $1.2 billion of the $6.3 billion in cryptocurrency stolen from the cryptocurrency exchange Binance in a recent hack. This action is part of a broader effort that has seen more than $2.7 billion in stolen assets frozen by U.S. authorities and private sector partners since the October 29th incident. Investigators are continuing their work to recover additional funds, the Department of Justice announced Thursday.

The FBI has attributed the Binance hack to North Korea’s TraderTraitor group, according to a cyber alert. However, Kim Yo Jong, the sister of North Korean leader Kim Jong Un, has denied the country’s involvement.

Binance stated that it has covered the affected assets with its own funds. A recent proof-of-reserves snapshot indicated that customer assets are backed at least one-to-one, the company posted on X.

This development follows a separate enforcement action announced by the DOJ in November 2025, which targeted approximately $15 million in cryptocurrency linked to North Korean hackers known as APT38.

FaceStealer Scam Exploits Deepfakes and Social Engineering

In a parallel operation, U.S. authorities have seized cloud infrastructure utilized in FaceStealer, a North Korean social engineering campaign that has pilfered over $400 million in cryptocurrency over the past 18 months, the DOJ reported.

The hackers employed a sophisticated scheme, using secretly recorded footage of previous victims and AI-generated deepfakes of prominent cryptocurrency figures to build trust during video calls. They then deceived targets into installing malware by presenting bogus technical fixes, according to the DOJ.

The FaceStealer campaign primarily targeted individuals working within the cryptocurrency and Web3 sectors. More recently, the hackers have also increasingly focused on open-source software developers and maintainers, aiming to gain access to their devices and software repository accounts.

Under a federal warrant, the FBI confiscated more than 900 webcam videos belonging to FaceStealer victims. The bureau also issued a public advisory providing guidance on how to protect against the scheme and outlining steps to take in the event of a compromise.

The DOJ identified the hackers behind FaceStealer as being publicly known by various aliases, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima.