DOJ Moves to Seize $1.2 Billion North Korea Stole From Binance, Knocks Out “FaceStealer” Scam

Written By TNT Staff, Posted on November 13, 2026

North Korea doesn’t pay for its weapons program by selling anything the world wants to buy. It steals. On Thursday, the Justice Department announced that it is taking more than $1.2 billion of that loot back.

In a Nov. 12 release, the department laid out two coordinated actions against the Kim regime’s cyber-theft operation: the court-authorized seizure and restraint of more than $1.2 billion in cryptocurrency recently stolen from the exchange Binance, and the takedown of cloud infrastructure behind a North Korean scam the FBI calls “FaceStealer,” which the FBI says has stolen more than $400 million over the past 18 months.

“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, the Principal Deputy Assistant Attorney General for National Security. “Today’s announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime.”

The biggest crypto heist on record, and the counterpunch

On or about Oct. 29, members of the North Korean military, a group the FBI calls “TraderTraitor,” stole more than $6 billion in digital assets from Binance. The FBI publicly pinned the theft on North Korea two days later and published hundreds of wallet addresses, asking exchanges, DeFi services and blockchain analytics firms to block any transactions touching them.

That alert mattered. According to the Justice Department, U.S. government and private-sector efforts have so far frozen more than $2.7 billion of the stolen assets, and prosecutors have already won court authorization to seize or restrain more than $1.2 billion of that amount.

Speed was the whole game. Stolen crypto that gets washed through enough bridges, mixers and swap services can vanish for good. Assistant Attorney General A. Tysen Duva of the Criminal Division said his team and its partners “played the critical role in immediately freezing billions of dollars’ worth of stolen Binance digital assets before they got beyond law enforcement reach,” and that the division moved “to immediately halt about half of this historic breach.”

“The North Korean regime may think they are sophisticated cyber criminals, but we have consistently met them head on, as we did here seizing more than $1.2 billion of their stolen assets,” said U.S. Attorney Jeanine Ferris Pirro for the District of Columbia.

The job isn’t finished. DOJ says efforts to “trace, freeze, seize, and forfeit” the rest are ongoing, because TraderTraitor actors are still laundering what they took through crypto bridges, mixers and exchanges. The work is spread across DOJ’s National Security Cyber Section, the Criminal Division’s Computer Crime and Intellectual Property Section, the D.C. U.S. Attorney’s Office, and the FBI, working with the Secret Service and IRS Criminal Investigation.

“FaceStealer”: a scam built on stolen faces

The second action is the one ordinary crypto users should study. In Los Angeles, federal prosecutors and the FBI disrupted cloud infrastructure that North Korean hackers used for FaceStealer. The FBI says these are the same hackers known in the security industry as Sapphire Sleet, BlueNoroff, APT38 and Stardust Chollima, among other names.

The scheme is cruel in a simple way. According to the FBI’s FLASH alert, the hackers take over a victim’s Telegram or other messaging account and message that person’s contacts to set up a friendly “catch up” or a talk about “investment opportunities.” The target gets a link that looks like Zoom or Teams but goes to a fake copy run by the hackers. When the target joins, the hackers play webcam video they secretly recorded from earlier victims, so the target sees people they know. Then comes a fake technical problem, such as a claim that the target can’t be heard, along with a “fix.” The fix is malware. The new victim’s webcam is recorded too, and their contacts become the next targets.

Under a federal warrant, the FBI seized more than 900 of those victim webcam videos. The bureau also says the hackers have begun using what it calls “super intelligence” to make deepfake videos of well-known figures in the crypto industry, which they slip into the fake calls. In some cases, the FBI says, the hackers waited months to more than a year after breaking in before emptying a wallet, letting the balance grow first.

“If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” said Patrick Grandy, Assistant Director in Charge of the FBI’s Los Angeles Field Office.

Not just a crypto problem

The FBI also warns that FaceStealer is being turned on the people who maintain open-source software, the free code that much of the internet runs on. Earlier this year, according to the FLASH, the hackers got into the computer of a maintainer of a major JavaScript library with “tens of millions of downloads per week” and used his access to add malicious code. Quick detection stopped it, but the FBI says the attack “could easily have resulted in very large-scale victimization.” Other attempts have hit maintainers on NPM and, more recently, Rust.

That is why this is a national-security story, not just a story about crypto traders. A hostile nuclear regime is stealing from Americans, using the money to build weapons, and probing the software supply chain that businesses and government rely on. Pyongyang has bet that U.S. agencies are too slow to keep up with stolen money moving at blockchain speed. Freezing billions in a matter of days says otherwise.

What to do

The FBI has set up a resource hub at fbi.gov/facestealer. Anyone who thinks they were targeted should file a report at IC3.gov with the keyword “FaceStealer.” The basic rule: if a video call from a friend suddenly needs you to download a “fix,” hang up and call that friend another way.

Sources: U.S. Department of Justice, Office of Public Affairs (Nov. 12, 2026); FBI FLASH AC-111226-MS (Nov. 12, 2026); FBI FaceStealer page; FBI Cyber Alert, “North Korea Responsible for $6 Billion+ Binance Attack” (Oct. 31, 2026).

TNT Staff