US wins authority to seize or restrain $1.2 billion in Binance theft

The US government said on 12 November that it had obtained court authorization to seize or restrain more than $1.2 billion stolen from cryptocurrency exchange Binance. The authorization does not itself establish that the assets have been recovered or returned.

The October 29 theft involved about $6.3 billion. Federal investigators and private-sector partners have helped freeze more than $2.7 billion of the stolen assets; the authorized seizure or restraint covers part of that total, not an additional sum.

ABC News used differing descriptions of the assets' status: its opening said the FBI had seized more than $1.2 billion, while its detailed account said the Justice Department had obtained authorization to seize or restrain that amount.

The court also authorized authorities to take down cloud-based infrastructure used in FaceStealer, a separate scheme that uses deception to target technology workers. The authorization permits a takedown; it does not establish that one has been completed.

Latest · 13 November 2026

The US Justice Department said it had seized cloud infrastructure used in FaceStealer, the separate scheme the FBI attributes to the North Korea-linked group Sapphire Sleet. DW reported that attackers sometimes waited months or more than a year before stealing funds, and that North Korea has denied involvement in the Binance hack.

Two operations linked to North Korea

The FBI previously attributed the 29 October Binance theft of about $6.3 billion to TraderTraitor, a North Korean hacking operation linked to Lazarus Group. Binance said the attackers began laying the groundwork in June for a multistage campaign involving fake job interviews, malware downloads, compromised internal AI tools, device takeover and an advanced transaction-authorization method.

The FBI attributes FaceStealer instead to Sapphire Sleet, a North Korea-linked group widely regarded as a Lazarus Group offshoot. Officials say FaceStealer stole more than $400 million in cryptocurrency over 18 months. FBI Cyber Division Assistant Director Brett Leatherman said Sapphire Sleet’s activity is part of a broader North Korean effort to raise revenue, steal virtual assets and gain access to networks and trusted online services.

How the fake meetings work

FaceStealer typically targets cryptocurrency and web3 workers and developers who maintain open-source software. The attackers seek access to the developers' software repositories as a first step toward attacks on the software supply chain, The Register said. The FBI said it had seized more than 900 webcam recordings belonging to targeted technology workers.

According to the FBI’s account, invitations come from hijacked accounts belonging to apparently familiar contacts. Jeremy Robertson, an FBI special agent who oversees counterintelligence and cyber investigations in Los Angeles, said previous conversations or shared interests can make an invitation seem genuine.

A link takes the target to a fake Zoom or Teams meeting. According to the FBI’s account, attackers secretly record the target’s webcam while playing prerecorded footage of the supposed inviter, who appears on screen without audible speech. A chat message then offers a supposed software upgrade to fix the audio. Accessing it installs cryptocurrency-stealing malware and sends the victim’s contacts to the attackers, allowing them to target others.

What can follow seizure

In such cases, the US government typically files a forfeiture claim, and a judge decides who has a legitimate claim to recovered funds, ABC News said.