North Korea's Binance hack faces U.S. crackdown as DOJ targets $1.2 billion in stolen crypto

Policy North Korea's Binance hack faces U.S. crackdown as DOJ targets $1.2 billion in stolen crypto Federal authorities say they've taken infrastructure used in the FaceStealer scheme used to steal as much as $400 million in crypto assets. By Jesse Hamilton | Edited by Aoyon Ashraf Nov 12, 2026, 5:55 p.m. EST 2 min read Make preferred on Share Share this article Copy link X icon X (Twitter) LinkedIn Facebook Email Make preferred on Enlarge image Summary Show The U.S. Justice Department highlighted two of its campaigns to counter North Korean hackers seeking to steal crypto assets, including its seizure of technology used to fake out targets in a video-conferencing scheme. The DOJ also said it's received court authority to seize more than $1.2 billion frozen after the recent theft at Binance. The U.S. Department of Justice said it's aggressively taking control of infrastructure and assets in North Korea's leading efforts to steal billions in crypto, including technology used in the "FaceStealer" thefts and an approved seizure of $1.2 billion in the cryptocurrency recently stolen in the attack on Binance. The authorized seizure is part of a broader effort by U.S. authorities and private companies that has frozen more than $2.7 billion of the more than $6 billion stolen from Binance on Oct. 29. The FBI attributed that attack to a North Korean military-linked hacking operation known as 'TraderTraitor.' Read more: What is TraderTraitor, the hacking squad behind the $6.3 billion Binance heist? Investigators are continuing to trace stolen cryptocurrency moving through blockchain bridges, mixers and exchanges, seeking to freeze and recover more of the funds, the DOJ said. “North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, principal deputy assistant attorney general for national security at the DOJ, in a statement. “Today’s announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime. The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.” In a separate operation, federal agents seized cloud infrastructure used in a North Korean hacking campaign known as FaceStealer, which the FBI says has stolen more than $400 million in cryptocurrency over the past 18 months. That scheme uses fake video meetings resembling Zoom or Microsoft Teams calls to trick victims into installing malware. Hackers impersonate trusted contacts using secretly recorded webcam footage from previous victims and, increasingly, AI-generated deepfake videos. Once a target joins a fraudulent meeting, the hackers claim there is a technical problem and instruct the victim to install software or run a command to fix it. The instructions instead install malware that can steal cryptocurrency and give attackers access to other systems. The FBI said it seized more than 900 webcam videos collected by the attackers, who have also targeted developers maintaining widely used open-source software. The agency warned that compromising a developer could allow hackers to gain access. Newsletters State of Crypto Examining the intersection of cryptocurrency and government. Preview Sign up By signing up, you will receive emails about CoinDesk products and you agree to our terms & conditions and privacy policy . Read more: CZ warns of more AI-driven hacks following Binance’s historic $6.3 billion heist North Korea Latest Crypto News 1 U.S. President names CFTC, SEC nominees for first time in a year 13 minutes ago 2 Kalshi ends Donald Trump Jr.’s advisory contract over 1789 Capital’s Polymarket investment 1 hour ago 3 Illinois crypto tax is impossible to enforce as written, crypto industry tells court 6 hours ago 4 DTCC adds Solana to Wall Street tokenization plans, targeting 2027 rollout 7 hours ago 5 Crypto for Advisors: The blockchain built to run financial markets 7 hours ago 6 Jupiter adds Anchorage-backed USDGO to its $1 billion Solana lending platform 8 hours ago 7 The next Congress will write rules for AI and emerging tech. They should use the stuff first. 8 hours ago 8 Nvidia CEO Huang quits company he co-founded, led for 3 decades. Shares slump 9 hours ago 9 Bitcoin weakness erases September's bullish signal 10 hours ago 10 UK bank Griffin raises $20 million to expand into stablecoin payments 10 hours ago Latest Research Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years. By CoinDesk Research Sep 24, 2026 Commissioned by RealFi Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years. Why it matters : Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years. View Full Report More From Policy U.S. President names CFTC, SEC nominees for first time in a year Kalshi ends Donald Trump Jr.’s advisory contract over 1789 Capital’s Polymarket investment Illinois crypto tax is impossible to enforce as written, crypto industry tells court