The U.S. Department of Justice has announced coordinated actions against North Korean crypto theft on two fronts. Prosecutors obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency traced to the roughly $6.3 billion Binance hack of late October, and the FBI dismantled FaceStealer, a deepfake video call scheme that authorities say stole more than $400 million over about 18 months.
Together, the actions mark one of the largest recovery efforts yet against state-backed crypto crime, and they arrive as Washington steps up pressure on illicit flows, following moves such as the Treasury action against MEXC.
What Happened in the $6.3 Billion Binance Hack?
On October 29, attackers drained roughly $6.3 billion to $6.4 billion from Binance hot wallets across multiple blockchains, mostly Ethereum and Bitcoin, in about 20 minutes. It is the largest crypto theft on record. The FBI and blockchain intelligence firms attributed the attack to TraderTraitor, a North Korean cluster linked to the Lazarus Group.
The response was unusually fast. Binance, analytics firms, and stablecoin issuers including Tether and Circle froze an estimated $2.7 billion to $3 billion of the stolen funds on-chain before it could be fully laundered. Binance said it covered affected user balances from its own reserves and its SAFU fund.
| Metric | Figure |
|---|---|
| Total stolen from Binance (Oct. 29) | ~$6.3–$6.4 billion |
| Attributed to | TraderTraitor (North Korea, Lazarus-linked) |
| Frozen on-chain by industry response | ~$2.7–$3.0 billion |
| DOJ court-authorized seizure or restraint | More than $1.2 billion |
| User losses | Covered by Binance reserves and SAFU |
How the FaceStealer Deepfake Scam Worked
FaceStealer did not break into exchanges. It targeted people. According to the DOJ and FBI, North Korean operators compromised accounts belonging to trusted contacts on platforms such as Telegram, LinkedIn, Slack, and Discord, and secretly recorded their video.
They then invited crypto workers and open-source developers to calls on imitation versions of Zoom, Microsoft Teams, or Google Meet. The "colleague" on screen was prerecorded or deepfaked footage. A staged audio or video glitch followed, and the victim was asked to download a fix. That file was malware that harvested credentials, browser cookies, and wallet keys.
Under federal search warrants, the FBI disrupted the cloud infrastructure behind the scheme and recovered more than 900 victim webcam recordings the hackers had stored.
How to Protect Your Wallet From Deepfake Call Scams
- Never install anything mid-call. Legitimate meeting platforms do not ask you to download audio drivers, SDKs, or "fix" scripts from a chat link.
- Verify through a second channel. If a contact sends an unexpected meeting link, confirm it by phone or a separate, known account before joining.
- Check the meeting domain. Fake clients often use lookalike URLs. Join only from the official app or a bookmarked domain.
- Separate signing from browsing. Keep long-term holdings in a hardware wallet and use a dedicated device or browser profile for transactions.
- Revoke and rotate after any doubt. If you installed something suspicious, move funds from hot wallets, revoke token approvals, and rotate exchange API keys and passwords.
Security incidents like the Gnosis Pay breach show the same pattern: attackers increasingly target people and infrastructure rather than smart contract code.
What the Seizure Means for Binance and the Market
For Binance users, the immediate impact is limited because balances were already made whole. The larger significance is legal: court-authorized seizures create a path for frozen assets to be forfeited rather than sitting in limbo. Combined with the industry freeze, roughly half of the stolen value has now been immobilized, an unusually high share for a North Korean operation. Follow ongoing coverage on our regulation desk.
Frequently Asked Questions (FAQ)
How much did the DOJ seize from the Binance hack?
The U.S. Department of Justice obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency traced to the roughly $6.3 billion theft from Binance in late October 2026.
Who was behind the $6.3 billion Binance hack?
The FBI and blockchain intelligence firms attributed the attack to TraderTraitor, a North Korean state-backed hacking cluster associated with the broader Lazarus Group.
What is the FaceStealer scam?
FaceStealer was a North Korean social engineering campaign that used compromised accounts and recorded or deepfaked video of trusted contacts on fake meeting calls. Victims were told to install a fix for a staged audio or video problem, which actually installed credential and wallet-stealing malware. Authorities say it stole more than $400 million over about 18 months.
How can I protect my crypto from deepfake video call scams?
Never install software or browser extensions requested during a call, verify unexpected meeting invites through a separate known channel, keep long-term holdings in a hardware wallet, and use a dedicated device or browser profile for signing transactions.