---
title: "Court Order Lets DOJ Lock Up $1.2 Billion of North Korea’s Stolen Binance Crypto"
url: https://thecoingazette.com/court-order-lets-doj-lock-up-1-2-billion-of-north-koreas-stolen-binance-crypto/
date: 2026-11-13
modified: 2026-11-13
lang: en
author: "Coin Gazette Editorial"
description: "The Justice Department also said the FBI took down servers behind \"FaceStealer,\" a video-call hacking scheme it ties to more than $400 million in crypto theft. The post Court Order Lets DOJ Lock Up $1.2 Billion of North Korea’s Stolen Binance Crypto appeared first on Unchained."
categories:
  - "Crypto News"
tags:
  - "crypto"
  - "cryptocurrencies"
  - "Defi"
  - "Market Trends"
  - "News"
word_count: 500
---

# Court Order Lets DOJ Lock Up $1.2 Billion of North Korea’s Stolen Binance Crypto

The U.S. Department of Justice (DOJ) has court authorization to seize or restrain more than $1.2 billion of the crypto North Korean hackers took from Binance, the department said Thursday. The same release laid out an FBI operation against “FaceStealer,” a scheme in which hackers use stolen webcam footage to fake trusted faces on video calls.
Members of North Korea’s military, a unit the FBI calls TraderTraitor, stole more than $6 billion in virtual assets from the exchange on or about Oct. 29, the DOJ said in the release. Government and private-sector efforts have since frozen more than $2.7 billion, and the $1.2 billion sits inside that frozen total. Assistant Attorney General A. Tysen Duva said in a statement that the Criminal Division moved to “immediately halt about half of this historic breach.”
Days after the hack, Pablo Sabbatella, founder of security firm Opsek, said on Unchained that in most hacks, “They hack you once and most of the funds are gone.” This time, he said, “the industry was quite fast” at freezing what it could.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

The Laundering Continues
The department said the hackers are still moving funds through bridges, mixers and exchanges. On Oct. 31, the FBI, the Secret Service and IRS Criminal Investigation put out an alert that blamed North Korea for the theft and asked virtual asset service providers, the exchanges and other firms that handle crypto for customers, to block transactions linked to TraderTraitor addresses. Blockchain analytics firm Elliptic said on Monday that some of the stolen crypto was being routed through homemade meme coins.
The National Security Division “will use every tool at its disposal to seize and return North Korea’s ill-gotten gains,” said M. Scott Proctor, its principal deputy assistant attorney general.
How FaceStealer Works
In a separate action, federal prosecutors in Los Angeles said they disrupted the cloud infrastructure behind FaceStealer, which the FBI links to more than $400 million in theft over the past 18 months. Agents also seized over 900 webcam videos of victims under a federal warrant.
The DOJ said the hackers send meeting invites from accounts hijacked from earlier victims, then play recorded clips of people the target already knows. Midway through, a staged glitch, such as a claim the target can’t be heard, leads to a “fix” that installs malware. The department said the group has also used what it called “super intelligence” to make deepfakes of public figures in crypto, though the FBI’s technical report says the scheme still relies “overwhelmingly” on real stolen footage.
Open-source developers are a growing target. The FBI said that earlier this year the maintainer of a widely used JavaScript library was infected through a fake Microsoft Teams call, and the attack was caught before it spread.
Related Listen: How North Korea’s Launderers Try to Shake Off Blockchain Analytics

The post Court Order Lets DOJ Lock Up $1.2 Billion of North Korea’s Stolen Binance Crypto appeared first on Unchained.