# Justice Department Wins Authority to Seize $1.2 Billion of Binance Funds It Ties to North Korea

The order covers part of the more than $2.7 billion that private firms had already frozen, and the FBI also took down the servers behind a deepfake video-call scheme that it says stole more than $400 million.

- Published: 2026-11-13T05:45:42.603Z
- Canonical: https://polylog.news/crypto/2026-11-13/justice-department-wins-authority-to-seize-1-2-billion-of-bi
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/policy/2026/11/12/north-korea-s-binance-hack-faces-u-s-crackdown-as-doj-targets-usd1-2-billion-in-stolen-crypto), [Bitcoin Magazine](https://bitcoinmagazine.com/news/doj-north-korea-binance-1-2-billion-seize), [Polylog editors](https://polylog.news), [Rekt News](https://www.rekt.news/), [The Block](https://www.theblock.co/news/business/2026-11-12-doj-seize-1-2-billion-binance-hack-north-korea-facestealer-439065), [CyberScoop](https://cyberscoop.com/us-seizes-north-korea-hacking-infrastructure-binance/), [Cryptonews](https://cryptonews.net/news/security/33744646/), [TFTC](https://tftc.io/north-korea-facestealer-deepfake-doj-binance-hack-seizure)

The United States Department of Justice (DOJ) said on November 12 that a federal court had authorized it to seize or restrain more than $1.2 billion connected to the October 29 theft from Binance, [CoinDesk reported](https://www.coindesk.com/policy/2026/11/12/north-korea-s-binance-hack-faces-u-s-crackdown-as-doj-targets-usd1-2-billion-in-stolen-crypto). The FBI attributes the theft to a North Korean military hacking unit it calls TraderTraitor, [according to The Block](https://www.theblock.co/news/business/2026-11-12-doj-seize-1-2-billion-binance-hack-north-korea-facestealer-439065).

The $1.2 billion is not freshly recovered money. [Bitcoin Magazine reported](https://bitcoinmagazine.com/news/doj-north-korea-binance-1-2-billion-seize) that it comes from more than $2.7 billion that stablecoin issuers, exchanges and analytics firms had already frozen. The court order converts part of that private freeze into a government claim that can lead to forfeiture. Estimates of the total theft vary. The DOJ puts the minimum above $6 billion, and Binance's own estimate is about $6.3 billion, [Cryptonews reported](https://cryptonews.net/news/security/33744646/). [Rekt News](https://www.rekt.news/) lists the Binance incident on its tracker of the largest crypto losses.

The DOJ also announced that it had taken down cloud infrastructure used in a campaign it calls FaceStealer. According to the department, operators used secretly recorded webcam footage and AI-generated deepfakes on live video calls to persuade victims to install malware. The DOJ says the campaign stole more than $400 million over about 18 months, and the FBI says it seized more than 900 webcam recordings, [CyberScoop and Cryptonews reported](https://cyberscoop.com/us-seizes-north-korea-hacking-infrastructure-binance/). The method is social engineering. The deepfakes replaced the forged documents and fake recruiters that North Korean groups used in earlier campaigns. [Aggregator headlines](https://t.me/BWEnews/16624) linked FaceStealer to the Binance theft. The mainstream coverage describes two separate operations and does not say FaceStealer was how the attackers got into Binance.

North Korea has denied involvement in both operations, [TFTC reported](https://tftc.io/north-korea-facestealer-deepfake-doj-binance-hack-seizure). The same outlet says more than $3 billion from the Binance theft is unaccounted for and is being laundered. Earlier tracking showed about 18,270 bitcoin held in 19 wallets. No issuer can freeze those coins.

## What this means

How much of the money comes back depends on what form it takes. Tokens from central issuers and balances on exchanges can be frozen quickly, through a request to the issuer. Bitcoin can only be stopped when the thieves try to convert it into cash or other assets. That is why roughly half of the stolen funds were frozen within days while the bitcoin portion has not moved. The exposed parties are North Korea's laundering network (over-the-counter brokers, cross-chain swap services and the Asian off-ramps that convert to cash) and any exchange that later receives tainted coins. The court order is new. The freeze itself was already expected and priced in. The common view treats the freeze as proof that crypto theft is now recoverable, and that view is wrong for the bitcoin portion. The closest precedent is the 2016 Bitfinex theft: the United States seized about 94,000 of the stolen bitcoin only in 2022, six years later. The likelier outcome is that the frozen stablecoins move through civil forfeiture within months while the bitcoin is laundered slowly over years. That read depends on the 19 wallets staying dormant or moving only in small amounts. A large bitcoin seizure at an exchange or over-the-counter desk within the next few months would prove it wrong.

## What to watch

- Whether the 19 wallets holding the stolen bitcoin begin to move. Movement would show the launderers testing off-ramps and give investigators a chance to intercept the coins.
- Civil forfeiture complaints against specific stablecoin balances. Those filings would show how quickly a private freeze becomes money the government keeps.
- New cases of deepfake video calls aimed at crypto firm staff. The FaceStealer takedown removes the servers but not the method.