# U.S. Prosecutors Win Authority to Seize $1.2 Billion From the Binance Theft and Take Down a North Korean Deepfake Operation

The $1.2 billion comes out of more than $2.7 billion that issuers and investigators have already frozen, and the Justice Department has set no timetable for returning it.

- Published: 2026-11-14T05:48:35.118Z
- Canonical: https://polylog.news/crypto/2026-11-14/u-s-prosecutors-win-authority-to-seize-1-2-billion-from-the
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CryptoSlate](https://cryptoslate.com/binance-funds-theft-us-court-orders-cover-over-1-2-billion-with-return-unresolved/), [Polylog editors](https://polylog.news), [Rekt News](https://www.rekt.news/)

The U.S. Department of Justice (DOJ) said on November 12 that courts had authorized it to seize or restrain more than $1.2 billion connected to the October 29 theft from Binance. The Federal Bureau of Investigation (FBI) attributes that theft to TraderTraitor, a North Korean state hacking unit. [CryptoSlate's reading of the release](https://cryptoslate.com/binance-funds-theft-us-court-orders-cover-over-1-2-billion-with-return-unresolved/) is that the orders cover part of more than $2.7 billion already frozen, so the money is not newly recovered, and that the DOJ gave no timetable for getting it back to victims.

The private sector did most of the freezing. [The Block reports](https://www.theblock.co/news/business/2026-11-12-doj-seize-1-2-billion-binance-hack-north-korea-facestealer-439065) that Tether, Ripple, Circle, World Liberty Financial and Arbitrum helped lock the funds, which works only on tokens an issuer or governance body can blacklist. The DOJ did not say how much of the frozen total is bitcoin. Bitcoin is the asset no issuer can freeze.

Binance's internal investigation attributes the theft to social engineering. The exchange said attackers [compromised a DevOps engineer's laptop](https://bleepingcomputer.com/news/security/binance-links-63-billion-crypto-theft-to-compromised-devops-laptop), reached a service container, and issued unauthorized withdrawal requests, and it found no evidence that private keys were leaked. Binance puts the loss at about $6.3 billion. Blockchain analysts traced the outflows across about ten blockchains, [most of them within roughly 20 minutes](https://siliconangle.com/2026/10/30/hackers-steal-6-3b-from-binance-in-biggest-ever-crypto-heist/).

Authorities also seized cloud infrastructure behind a separate scheme the FBI calls FaceStealer, [according to CyberScoop](https://cyberscoop.com/us-seizes-north-korea-hacking-infrastructure-binance/). The FBI says North Korea-linked operators ran it for 18 months and took more than $400 million. They lured targets into video meetings that used recorded footage of earlier victims or deepfakes of well-known crypto figures. Agents seized more than 900 webcam recordings of victims. The [BWE News wire](https://t.me/BWEnews/16624) summarized the DOJ website as tying FaceStealer to the Binance attack. Kim Yo Jong, sister of North Korean leader Kim Jong Un, [denied North Korean involvement](https://cointelegraph.com/news/doj-12b-north-korean-crypto-seizure-400m-facestealer-scheme?amp=&amp=). [Rekt News](https://www.rekt.news/) has published its own write-up of the Binance breach.

## What this means

Centrally issued stablecoins now function as a tool for enforcing U.S. policy. Issuers can freeze funds within hours, and courts then convert those freezes into forfeiture claims. North Korea bears the resulting cost: laundering stolen funds through dollar stablecoins now carries a high risk of forfeiture. That pushes its operators toward bitcoin and toward over-the-counter brokers in Asia that operate outside U.S. jurisdiction. The cost to Binance's users is time. Forfeiture and remission move at the pace of the court process. In the Bitfinex case, bitcoin stolen in 2016 was seized in 2022, and the dispute over who got it back ran for years after that. The desk's read is that the frozen stablecoin share will reach Binance and its users only through court-supervised remission over many months, while the bitcoin remainder moves through cross-chain swaps and brokers as North Korea tries to cash out. That read is wrong if the DOJ announces an expedited return to Binance within weeks, or if large bitcoin tranches reach regulated exchanges and are seized there.

## What to watch

- Whether the DOJ files a remission or restitution process that names Binance or its users as the victim. That filing decides who gets the money and when.
- Movement in the bitcoin still held by the attackers. Transfers toward exchanges or brokers would show North Korea trying to convert the one asset it can still use.
- New FaceStealer-style video-call approaches reported by crypto executives. More reports would show the seizure removed infrastructure but not the operating method.