.jpg)
Key Notes
- US authorities obtained court approval to seize or restrain more than $1.2 billion stolen from Binance.
- Those assets form part of more than $2.7 billion frozen through public and private sector cooperation.
- The separate FaceStealer infrastructure takedown targets a deepfake scheme linked to over $400 million in crypto thefts.
US authorities have obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, the Justice Department said, alongside a separate takedown of North Korean deepfake infrastructure.
The department’s November 12 announcement describes coordinated action against two operations. The Binance recovery concerns assets from the October 29 theft. The infrastructure operation targets FaceStealer, a campaign using deceptive video meetings to compromise cryptocurrency holders and software developers.
Court Orders Cover Part of the Frozen Assets
Government agencies and private-sector partners have frozen more than $2.7 billion connected to the Binance theft, according to the DOJ. The assets subject to the $1.2 billion-plus court authorization form part of that larger frozen pool.
Those figures measure different stages of recovery and should not be added together. Authorization to seize or restrain assets also does not establish that the full amount has been forfeited or returned to Binance.
The FBI’s October 31 cyber alert attributed the theft of more than $6 billion to North Korea’s TraderTraitor operation. Investigators said they had observed stolen assets being converted primarily into ether.
The bureau, the Secret Service and IRS Criminal Investigation urged crypto service providers and blockchain operators to block transactions connected to identified laundering addresses. Tracking those assets involves following transfers across services and networks rather than relying on a single exchange account.
FaceStealer Is a Separate Campaign
The FBI’s FaceStealer overview links that scheme to more than $400 million in cryptocurrency thefts over 18 months. Investigators seized over 900 webcam recordings of victims and disrupted cloud infrastructure used in the operation.
Attackers hijack communication accounts, contact the victims’ associates and invite new targets into convincing imitation video calls. Secretly recorded footage and deepfake videos of familiar or influential people help the impostors appear trustworthy.
During a meeting, the attackers introduce a supposed technical problem and offer a link or prompt to fix it. Following the instructions installs malware, giving the intruders access to the target’s computer. The DOJ says some thefts occurred months to more than a year after the initial compromise.
The FBI says the campaign increasingly targets open-source developers and maintainers. Access to their devices and repository accounts can enable malicious code to reach people who rely on their software.
Recovering Funds Remains an Ongoing Process
The actions extend the federal response described in CoinScreamer’s earlier recovery coverage. The Secret Service had said it was working with other agencies and industry partners to trace and freeze the stolen Binance assets.
That effort is separate from Binance’s replacement funding, which uses company resources to restore affected token balances. The DOJ says efforts to trace, freeze, seize and forfeit the original stolen assets continue as the attackers move funds through bridges, mixers and exchanges.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
