$1.2 billion. That is the slice of the Binance loot the US Justice Department can now legally take, after a court signed off on seizing crypto from the October 29 attack. The department announced the move on November 12, in the sharpest US crypto regulation action since the theft, and paired it with the takedown of a second North Korean scheme that stole more than $400 million through fake video calls.
The court order covers more than $1.2 billion in crypto frozen after the Binance theft, per CoinDesk, inside a wider freeze of more than $2.7 billion built by US authorities with private-sector firms. The theft ran to more than $6 billion, the department said, while Binance put its own losses at about $6.3 billion, per The Block. The FBI blames TraderTraitor, a hacking operation tied to the North Korean military.
The $1.2 billion is not a fresh recovery. It comes out of the $2.7 billion already frozen, per Bitcoin Magazine, and the court authorization is the legal step toward taking ownership through forfeiture. M. Scott Proctor, the DOJ's principal deputy for national security, said in a statement carried by CoinDesk that North Korea funds its regime and weapons program with stolen crypto, and vowed the department would use every tool to seize the gains. Binance has said it covered affected customer balances from its own funds, setting aside $6.34 billion, per The Block, so the seizure fight is over the thieves' proceeds, not user deposits.
The second operation hit FaceStealer, a scheme the FBI named. North Korean hackers lured crypto and Web3 workers into video meetings on imposter versions of Zoom, Microsoft Teams and Google Meet, then played prerecorded webcam footage of trusted contacts, or AI deepfakes of known figures, to win trust. Once the target joined, the hackers claimed a technical fault and sent a fix that installed malware. The FBI said the scheme stole more than $400 million over 18 months, seized the cloud infrastructure behind it, and took more than 900 webcam videos of victims under a federal warrant.
The recovery ledger so far
| Bucket | Amount | Status |
|---|---|---|
| Stolen from Binance, Oct 29 | About $6.3 billion | TraderTraitor blamed |
| Frozen by US authorities and firms | More than $2.7 billion | Frozen |
| Court order, Nov 12 | More than $1.2 billion | Seizure authorized |
| Still unaccounted | About $3.6 billion | Being traced |
| FaceStealer theft, 18 months | More than $400 million | Infrastructure seized |
The $2.7 billion freeze equals about 43% of the $6.3 billion stolen, locked down within two weeks. The $1.2 billion under court authority is about 44% of the frozen total, leaving roughly $3.6 billion in play. FaceStealer averages about $22 million a month across 18 months, and it shows the same state actor runs two tracks at once: one direct exchange theft and one social-engineering campaign.
Why it matters
A court-authorized seizure at this scale is new ground for crypto theft recovery, and the 43% freeze rate inside two weeks is far above what past exchange hacks produced. The freeze worked because token issuers, exchanges and US agencies moved together fast enough to catch funds before they left law-enforcement reach, per the department. For Binance users the point is the one the exchange has repeated since October 29: customer balances were covered from company funds. For the rest of the industry the warning sits in the FaceStealer detail: the victims were crypto workers and developers, picked off in meetings that looked like their own colleagues. The Binance exchange page tracks the venue's standing across these shifts.
What to watch
- Forfeiture proceedings for the $1.2 billion, and what the court papers name.
- Tracing of the remaining $3.6 billion, and whether more freezes land in the coming weeks.
Key points
- The DOJ won court authority on November 12 to seize or restrain more than $1.2 billion in crypto stolen from Binance.
- Of the roughly $6.3 billion stolen on October 29, more than $2.7 billion has been frozen.
- The FBI blames TraderTraitor, a hacking unit tied to North Korea's military, for the Binance theft.
- The FBI seized cloud infrastructure behind FaceStealer, a fake video-call scheme that stole more than $400 million in 18 months.
- More than 900 webcam videos of FaceStealer victims were seized.
- Binance covered affected customer balances from its own funds, setting aside $6.34 billion.
MarketRadar take
Freezing 43% of a $6.3 billion haul in two weeks means the industry's freeze machinery can now move at the speed of the thieves. What stays open is the other $3.6 billion, still being laundered through bridges and mixers, and the FaceStealer track, which needs no exchange breach at all, just one trusted face on a video call.
