US Seize $1.2 Billion of the Record Binance Hack Loot, Puts North Korea's Crypto Army in the Crosshairs

Two weeks after hackers drained billions from Binance in the biggest crypto theft on record, Washington has started taking some of it back. The US Department of Justice said Thursday it had obtained court authorization to seize or restrain more than $1.2 billion of the $6.3 billion in cryptocurrency stolen from Binance. The FBI has pinned the attack on a North Korean military hacking unit called TraderTraitor, and Pyongyang has angrily denied it.

The Justice Department also announced a second blow against North Korea's cyber operations. US authorities took down the infrastructure behind a deepfake video-call scam that has quietly emptied crypto wallets around the world.

$2.7 Billion Frozen So Far

The $1.2 billion is only part of what investigators have managed to lock down. The authorization covers part of the more than $2.7 billion in stolen assets that US authorities and private-sector partners have frozen since the Oct 29 hack.

The trail is still live. Investigators are still tracing stolen assets as the hackers move them through crypto bridges, mixers and exchanges, the department said. That means more than half of the stolen haul is still out of reach.

Victims should not expect their money back quickly. When the government seizes assets in such cases, it typically submits a forfeiture claim to the court, and a judge then rules on which parties are legitimately entitled to the money that was recovered, according to The Associated Press.

M. Scott Proctor, the senior Justice Department official in charge of national security, made the government's motive plain. He said "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," and that the National Security Division will use its tools to seize and return the gains.

Twenty Minutes, Ten Blockchains, $6.3 Billion

The scale of the October heist shocked an industry that is used to large thefts. Attackers moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in about 20 minutes, according to blockchain analytics firm TRM. The previous record was the $1.5 billion Bybit theft in February 2025, also attributed to North Korean hackers.

Binance says the breach was set up over several months. The attack began in June with a poisoned coding tool, and a fake job interview helped the hackers infect a second engineer's computer in September. According to the exchange's internal findings, the attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.

Indian investors know this playbook. WazirX, one of India's best-known exchanges, lost about $230 million in a July 2024 breach that was also linked to North Korean hackers. Many users had funds locked for months while the exchange went through restructuring.

Pyongyang Cries Foul

North Korea has rejected the accusation outright. Kim Yo-jong, in a statement released by the KCNA state news agency, said the Federal Bureau of Investigation's claim was "absurd rhetoric and nothing new". The sister of leader Kim Jong Un went further, proposing that attention be paid to who would benefit from the return of the stolen funds, suggesting it could reveal the organisers of the attack. She did not provide evidence of Washington's involvement in the hack.

Independent investigators reached the same conclusion as the FBI. The FBI, TRM Labs, Chainalysis and ZachXBT linked the attack to North Korea's TraderTraitor group.

FaceStealer: The Deepfake Scam on Your Next Video Call

The second operation may matter more to ordinary crypto users. The DOJ said it seized cloud infrastructure used in a North Korean campaign the FBI calls FaceStealer. The scheme is linked to more than $400 million in crypto theft over the past 18 months.

The method is simple and very effective. Hackers used stolen accounts to invite victims to video calls. There, they played recordings or deepfakes of familiar people, faked technical problems, and tricked victims into installing malware that could steal crypto or access other systems. Each victim then becomes a way into the next: hackers used stolen contacts and accounts to target more people, including open-source software developers, potentially to attack through their software.

The attackers were patient. In some cases, the theft and takeover of communication accounts occurred months to more than a year after the initial computer compromise. The FBI seized more than 900 webcam videos of FaceStealer victims and issued guidance for those affected.

Patrick Grandy, who heads the FBI's Los Angeles field office, warned that the scam exploits people's trust in everyday video conferencing platforms and personal relationships. He added that anyone who thinks they could never fall for it is underestimating the threat.