The U.S. Justice Department has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance during the October 29 attack, a legal step toward recovering part of the $6.34 billion theft. The department’s November 12 announcement also disclosed the disruption of cloud infrastructure used in a separate North Korean social-engineering campaign called FaceStealer, which authorities link to more than $400 million in crypto thefts.
The court-authorized amount is included within the more than $2.7 billion in Binance-linked assets that U.S. authorities and private-sector partners say they have frozen. It is not a further $1.2 billion discovered on top of those frozen funds, and the department did not say the full authorized amount had already been forfeited or returned to the exchange.
The two operations concern distinct investigations. The FBI attributes Binance’s theft to a North Korean operation it calls TraderTraitor, while the FaceStealer case targets a network that used fraudulent video meetings, stolen webcam recordings and malicious software to compromise cryptocurrency holders and software developers.
More than $1.2B gets court authorization after Binance freezes
In its November 12 statement, the Justice Department said efforts by federal investigators, law enforcement partners and virtual-asset businesses had frozen more than $2.7 billion of the stolen funds. The department has secured court authorization covering more than $1.2 billion of that pool.
These are different stages of the recovery process. A token issuer or exchange may immobilize assets to prevent their transfer, while a judicial seizure or restraint order gives law enforcement a legal basis to control particular property. Final forfeiture and any restitution to an affected party can require further steps. The department did not disclose which tokens or addresses were covered by the orders or how much value had actually been returned.
The latest figures are also narrower than some earlier estimates from Binance and blockchain investigators, which put frozen or intercepted assets at roughly $2.8 billion to $3 billion. The statements were made at different times and may use different inclusion criteria. They should not be combined into a running recovery total without a reconcilliation of the underlying assets.
North Korean TraderTraitor actors continue to move other proceeds through exchanges, mixers and cross-chain services, according to the department. The FBI’s October 31 alert identified addresses associated with the theft and called on service providers to block subsequent laundering transactions. DaveFinances’ earlier coverage of Elliptic’s tracing described more than 20,000 linked addresses, demonstrating the scale of monitoring required without treating transfers between those addresses as fresh thefts.
Binance says customer assets are replenished, not recovered
In a seperate update issued November 13, Binance said it had completed replacing the affected token assets using more than $6.34 billion in company resources, including corporate funds and parts of its user-protection and futures insurance reserves. It pledged to restore its Secure Asset Fund for Users to approximately $1 billion.
The exchange also announced a new proof-of-reserves snapshot, taken at 00:00 UTC on November 12 and covering 198 tokens. Binance said the complete zero-knowledge proof would require approximately 40 to 50 hours to generate, after which eligible users could independently check its asserted minimum one-to-one backing. A snapshot and promised proof are not the same as an independently completed verification, and the company is still restoring withdrawal services in phases.
Replenishment and law-enforcement recovery cannot be added together as if both were new funds credited to customers. Binance’s balance-sheet commitment addresses what customers are owed, while the government’s court orders address property linked to the attackers. DaveFinances previously tracked the phased restart of Binance withdrawals when replacement coverage was still incomplete. The new disclosure is an improvement in the exchange’s reported backing, not evidence that the DOJ has recovered the entire theft.
FaceStealer used fake meetings and 900 stolen webcam videos
In the separate FaceStealer investigation, the FBI seized cloud infrastructure that helped North Korean actors impersonate trusted contacts during video calls. Investigators obtained more than 900 secretly recorded webcam clips, which the attackers used to make fake Zoom or Teams meetings appear genuine. Some calls also featured AI-generated videos of well-known crypto figures.
The FBI says the attackers often entered a target’s circle through a hijacked Telegram, LinkedIn, Slack or Discord account. They sent a plausible meeting invitation, then replayed footage of someone the target recognised. A simulated audio problem provided the pretext for asking the victim to install a supposed fix, run a script or paste commands into a terminal. The action installed malware, giving attackers access to cryptocurrency and sometimes to the victim’s professional accounts.
Not every theft followed immediately. The FBI documented cases in which attackers waited months or more than a year after compromise, until crypto balances increased or additional accounts became useful. The agency says the FaceStealer campaign stole more than $400 million over 18 months. That figure relates to this broader campaign and should not be added to the Binance loss as if the government had identified a new component of the same attack.
The risk reaches software supply chains. The FBI described a case in which hackers infected a maintainer of a popular JavaScript library through a fake video meeting and tried to introduce malicious dependencies into software downloaded tens of millions of times weekly. The attempt was detected before it could spread widely. It is a potential multipler of harm, not a confirmed theft of those users’ funds.
The tactic differs from the bogus coding interview that contributed to the Binance breach, but both rely on persuading a trusted person to execute dangerous code. Binance’s security chief had warned about malicious recruitment assessments before the incident. Neither account proves that FaceStealer operators were the same individuals behind the exchange’s specific intrusion.
The Justice Department’s latest action establishes legal authority over part of the immobilized Binance funds and removes FaceStealer infrastructure from the attackers’ use. The still-unanswered questions are how much stolen cryptocurrency can ultimately be forfeited and returned, and whether the disruption has prevented the FaceStealer operators from rebuilding their decoy meetings elsewhere. Those outcomes have not yet been documented.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.