On November 12, 2026, the US Department of Justice (DOJ) announced two operations against North Korean networks involved in the theft of cryptocurrencies. Authorities have obtained judicial authorization to seize or immobilize more than $1.2 billion from the Binance hack. They also neutralized the cloud infrastructure of FaceStealer, a deepfake manipulation campaign responsible for more than $400 million in crypto theft in 18 months. These two cases illustrate different methods, but the same strategy for exploiting the crypto ecosystem.
In brief
- DOJ obtains judicial authorization for more than $1.2 billion stolen in the Binance hack.
- US authorities and their partners have already frozen more than $2.7 billion in stolen crypto funds.
- The FBI attributes the Binance hack to the North Korean group TraderTraitor.
- The FaceStealer network allegedly stole more than $400 million in cryptocurrencies in 18 months using social engineering techniques and deepfakes.
- The FBI seized more than 900 webcam videos related to this campaign.
More than $1.2 billion targeted after Binance hack
The DOJ obtained court authorization to seize or immobilize more than $1.2 billion from the Binance hack that occurred on October 29, 2026. This sum represents part of the digital assets already frozen thanks to the cooperation of the American authorities and players in the crypto sector.
According to the official press release from the Department of Justice, more than $2.7 billion frozen on a loot estimated at more than 6 billion. The FBI attributes the attack to members of the North Korean military known as TraderTraitor.
Investigators continue tracing crypto funds. Those behind the Binance hack are attempting to launder assets through:
- bridges;
- mixing services;
- different cryptocurrency exchange platforms.
They even managed to launder $430,000 through memecoins created on the NEAR protocol.
Important clarification: the judicial authorization relating to 1.2 billion dollars does not mean that this amount has already been definitively recovered. The freezing of assets, their seizure and their possible confiscation constitute distinct stages.
For its part, Binance claims to have mobilized more than $6.34 billion in resources to cover affected assets. In his announcement of November 12the crypto exchange also indicates that it has published a new snapshot of its reserves. This financial coverage announced by the company should not be confused with the legal recovery of stolen funds.
FaceStealer: $400 million stolen thanks to deepfakes
The second American operation targets the cloud infrastructure used by FaceStealer. According to the DOJ, this North Korean campaign resulted in more than 400 million dollars in theft crypto in the last 18 months.
Its operation is based on social engineering:
- Hackers first use compromised accounts to invite their victims to video conferences.
- They then discreetly record their webcam and broadcast pre-recorded videos or deepfakes of people known to their interlocutors.
Once trust is established, hackers simulate a technical problem. They then propose a link or a manipulation supposed to restore the functioning of the meeting. In reality, this so-called solution installs malware on the victim’s computer.
Hackers can then steal crypto assets, hijack communications accounts or exploit compromised computer access. Some intrusions would have produced their effects several months after the initial infection.
The campaign also targets developers and maintainers of open source software. The potential goal: access their devices and code repository accounts to prepare attacks against the software supply chain.
As part of this operation, the FBI seized more than 900 webcam videos under a federal mandate. The agency also published a space dedicated to FaceStealer. This gathers information about the threat as well as recommendations for people who may have been compromised.
This method is part of a broader context of infiltration of the crypto ecosystem by North Korean actors. We are particularly referring to alerts concerning fake North Korean developers targeting companies in the sector.
Two American operations against different methods of theft
THE Binance and FaceStealer files do not designate a single hack:
- The first concerns the massive misappropriation of assets from an exchange platform, attributed by the FBI to TraderTraitor.
- The second is based on the manipulation of victims through fake videoconferences, recorded videos and deepfakes.
Their rapprochement, however, reveals the extent of threats targeting the crypto sector. The fact is that cybercriminals are no longer just looking to compromise wallets or platforms. They also exploit professional relationships, communication tools and development environments to gain sensitive access.
The DOJ is therefore now continuing operations to trace, seize and confiscate assets resulting from the Binance hack. For crypto players, the case highlights the importance of secure communications and development environments, beyond just protecting digital wallets.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
