DOJ Seizes $1.2B Binance Hack Crypto, Busts FaceStealer Scam

On Thursday 12 November 2026, the US Department of Justice announced the biggest legal step yet in the recovery from the $6.3 billion Binance hack — court authority to seize or restrain more than $1.2 billion of the stolen cryptocurrency — and, in the same announcement, the takedown of a separate North Korean scam called FaceStealer that has stolen more than $400 million through fake video calls. The two actions are linked by the same adversary: the FBI attributes the Binance theft to TraderTraitor, a North Korean military-linked hacking operation, and attributes FaceStealer to Sapphire Sleet, a group widely regarded as an offshoot of the Lazarus Group. This guide explains what the court order actually does, how FaceStealer works and why it matters for Indian tech workers and crypto users, and what is still unresolved.

> Educational content only. This is not financial advice. Crypto markets are volatile — never invest money you can't afford to lose. This guide explains a published law-enforcement announcement; it does not recommend buying, selling or holding any asset, and it does not predict where prices will go.

What Happened: The Facts at a Glance

The facts, as reported on 12–13 November 2026 by CoinDesk, The Block, The Register, Bitcoin Magazine, The Cyber Express and the US Department of Justice itself, are:

• A court authorised the seizure or restraint of more than $1.2 billion. The US Department of Justice said on 12 November that it had obtained court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance. At the rupee rate of about ₹94.09 to the dollar on 13 November, that is roughly ₹11,290 crore.
• The $1.2 billion is part of a larger freeze, not on top of it. US authorities working with private-sector partners have frozen more than $2.7 billion of the stolen funds — about ₹25,400 crore. The $1.2 billion covered by the court orders sits inside that $2.7 billion total, so the two figures cannot be added together. The department said the freeze had halted about half of the theft.
• The theft itself was about $6.3 billion. On or about 29 October 2026, members of the North Korean military — referred to by the FBI as TraderTraitor — stole more than $6 billion worth of virtual assets from Binance, according to the department. Binance's own estimate was about $6.3 billion, or roughly ₹59,300 crore, and blockchain analysts at Elliptic put the figure at $6.43 billion.
• The FBI blames a North Korean military hacking unit. The FBI formally attributed the attack to TraderTraitor on 31 October, and the department's 12 November announcement repeats that attribution. The group is described as a North Korean military-linked operation, and the department said the stolen funds help bankroll North Korea's government and its weapons programme.
• FaceStealer's infrastructure was seized in the same announcement. Separately, federal agents seized cloud infrastructure used in a North Korean campaign the FBI calls FaceStealer, which the FBI says has stolen more than $400 million — about ₹3,760 crore — in cryptocurrency over the past 18 months. The FBI also said it had seized more than 900 webcam videos collected by the attackers.
• The stolen funds are still moving. The department said TraderTraitor actors are still moving the stolen assets through cryptocurrency bridges, mixers and exchanges, and that tracing, seizure and forfeiture work continues. The court papers behind the $1.2 billion order were not posted with the announcement, and the department did not say how much of the amount is bitcoin.

Two points in the announcement deserve emphasis because they are easy to misread. First, a seizure order is not a recovery. Freezing stops money from moving; seizing, through a court order, lets the government take control of it through forfeiture. Neither step puts money back in a victim's wallet by itself. Second, the $1.2 billion figure is a slice of the $2.7 billion freeze, which is itself less than half of the roughly $6.3 billion stolen. The rest — about $3.1 billion by the Elliptic accounting published on 6 November, mostly held in ether and bitcoin — remains in addresses linked to the attackers, and the department's own statement makes clear that the hunt for it is still going on.

What a Seizure Order Actually Means

The words "freeze", "seize" and "recover" are used almost interchangeably in headlines, but they describe three different things, and the difference matters for anyone waiting for stolen funds to come back.

A freeze is the first step. When stolen cryptocurrency is traced to an exchange account or a token issuer's blacklist, the funds can be stopped from moving. Stablecoin issuers can freeze tokens at an address. Exchanges can lock accounts. In the Binance case, that happened fast: within days of the 29 October theft, Binance said about $2.85 billion had been frozen or intercepted, and the US government and its private-sector partners have now frozen more than $2.7 billion in total. A freeze is defensive. It stops the bleeding, but it does not decide who the money belongs to.

A seizure order is the legal step that follows. A court authorises the government to seize or restrain specific funds — in this case, more than $1.2 billion of the frozen total. That authorisation is what lets the government move from holding the funds in place toward taking ownership of them through forfeiture. The department's announcement is careful about this: it says it has "obtained court authorization to seize or restrain" the funds, not that it has already taken them. The underlying court papers were not published with the announcement, so the exact assets, addresses and legal basis are not public yet.

Forfeiture is the step after that. Through a court process, the government asks a judge to declare that the seized property is the proceeds of crime and transfer ownership to the state. Only after forfeiture can the government decide what happens to the money — including, in some cases, returning it to victims. That process takes time, and it is not automatic. The department's statement says its National Security Division "will use every tool at its disposal to seize and return North Korea's ill-gotten gains", but it does not promise a timeline, and it does not say that Binance users will be repaid from the seized funds.

That is why the distinction matters for Indian users in particular. Binance has separately said it finished covering all user assets hit by the hack from its own funds and its SAFU safety fund, and that a new proof-of-reserves snapshot, with a zero-knowledge proof, will let users check one-to-one backing. If that is accurate, Binance users do not need the seized $1.2 billion to be made whole — the exchange has already covered the loss. But the seized funds still matter: every dollar the government takes out of the attackers' hands is a dollar that cannot fund the next operation, and every successful forfeiture makes the next theft less profitable.

The department's own language underlines the scale of what was stopped. A. Tysen Duva, the Assistant Attorney General for the Criminal Division, said the department and its partners were able to "immediately halt about half of this historic breach" by freezing stolen assets "before they got beyond law enforcement reach". M. Scott Proctor, the principal deputy assistant attorney general for national security, said: "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft." The message is that this was not just a theft from one exchange. It was, in the department's framing, state-sponsored fundraising — and the response is a law-enforcement operation, not a customer-service one.

FaceStealer: The Deepfake Video-Call Scam

The second half of the 12 November announcement is, for most readers, the more important half — because it describes a scam that could target anyone who works in tech, and it is still active in its methods even though its infrastructure was seized.

FaceStealer works like this. A victim — often a developer, an engineer, or someone who works with cryptocurrency — receives an invitation to a video meeting. The meeting looks like an ordinary Zoom or Microsoft Teams call. On the other end is someone the victim trusts: a colleague, a recruiter, a business contact. Except it is not that person. The hackers impersonate trusted contacts using secretly recorded webcam footage from previous victims and, increasingly, AI-generated deepfake video. The face on the screen is familiar. The voice sounds right. The meeting feels routine.

Then the trap closes. Once the victim has joined, the hackers claim there is a technical problem — the audio is not working, the screen share needs a plugin, the call needs a fix. They instruct the victim to install a piece of software or run a command to fix it. The instructions instead install malware. That malware can steal cryptocurrency from wallets on the victim's machine and give the attackers access to other systems. The FBI says the campaign has stolen more than $400 million in cryptocurrency over the past 18 months, and that the attackers have also targeted developers who maintain widely used open-source software — because compromising one developer can open the door to every project that developer touches.

The FBI attributes FaceStealer to a North Korean-linked group tracked as Sapphire Sleet, which is widely regarded as an offshoot of the Lazarus Group — the same family of operators behind the Binance theft. The disruption was led by Assistant US Attorney Khaldoun Shobaki of the Central District of California and the FBI's Los Angeles Field Office, with the Secret Service and the IRS Criminal Investigation division also involved in the wider Binance recovery effort. The FBI has published a report on the scheme, protective practices and steps for victims, and launched a resource hub at fbi.gov/facestealer.

Three details in the FaceStealer story should worry Indian readers in particular. First, the method is a close cousin of the fake-job-interview technique used in the Binance hack itself: in that attack, an engineer was lured through a fictitious company's interview process and tricked into running a malicious coding assignment. FaceStealer uses the same psychology — a professional context, a familiar face, a small technical request — and scales it with deepfakes. Second, India has one of the world's largest populations of software developers and crypto users, and a fake video call from a supposed recruiter or colleague is exactly the kind of approach that works in a market where remote interviews and freelance gigs are routine. Third, the scam does not need the victim to be rich. It needs the victim to install one piece of software. The $400 million total was built from many victims, not one big one — and the median victim in similar campaigns loses a few thousand dollars, not a fortune.

The takedown is real — the cloud infrastructure is seized, and more than 900 webcam videos were taken out of the attackers' hands — but it is not the end of the scheme. The department's announcement describes the seizure of infrastructure, not arrests, and the same operators have rebuilt before. The FBI's advice is practical: verify the identity of anyone who invites you to a video call through a second channel before joining, never install software or run commands at the request of someone on a call, and treat any "technical problem" that requires you to download something as a red flag in itself.

How This Differs From What Came Before

This is the fifteenth post on this site about the Binance hack and its aftermath, so it is worth saying plainly why this one is not a repeat.

The FBI attribution post of 1 November covered the formal finding that North Korea's TraderTraitor operation was behind the theft. That was an identification — who did it. The Elliptic accounting post of 7 November covered where the stolen funds were: $3.11 billion still held by the attackers, $2.85 billion frozen or seized, about $124 million converted. That was an inventory — where the money is. The 12 November announcement is neither. It is a legal action: a court order that moves part of the frozen total into the forfeiture process, plus the takedown of a second, previously undisclosed scam run by the same network. That is a new development, not a new telling of an old one.

It also closes a gap that the earlier posts left open. The attribution post said no government had formally attributed the attack — and then the FBI did. The accounting post said most of the stolen funds were still in the attackers' hands, with no legal mechanism yet in place to take them. The 12 November announcement supplies that mechanism, at least for $1.2 billion of the total, and it does so alongside a warning about a scam that had not been publicly described before. FaceStealer had no dedicated coverage on this site, and no prior post in the Binance series mentioned it.

The timing matters too. The announcement came on 12 November, the same day Bitcoin fell below $72,000 after Nvidia's chief executive resigned, and a day before it fell below $70,000 as the dollar hit a 19-month high. Those market falls are a separate story, covered separately. But the law-enforcement story is the one with a longer shelf life: a court order does not expire at the market close, and a deepfake scam does not stop because the price fell.

What This Means for Indian Users

The DOJ announcement is an American legal action about a theft from a global exchange, and its direct effect on Indian crypto users is limited. But it touches Indian users in four concrete ways.

FaceStealer is a direct threat to Indian tech workers. India has millions of software developers, and remote interviews, freelance contracts and cross-border collaboration are everyday life. A fake video call from a supposed recruiter, client or colleague is not an exotic scenario — it is a normal working day. The defence is simple and does not cost anything: verify the caller's identity through a second channel (a message on a different app, a call to a known number) before joining, never install software or run a command because someone on a call told you to, and remember that a familiar face on a screen is no longer proof of identity. Deepfakes have made the face unreliable. The second channel is the verification.

The fake-job method keeps coming back. The Binance hack began, in part, with a fake job interview. FaceStealer uses fake video meetings. The pattern is the same: a professional pretext, a small technical request, and malware at the end of it. Indian users who are job-hunting or freelancing in crypto and tech should treat any interview process that asks them to install software, run code from an unknown source, or download a "test" file as a serious warning sign. A genuine employer does not ask a candidate to run untrusted code on their own machine.

Do not trust "recovery" offers. Every major theft produces a wave of secondary scams: messages offering to recover stolen funds for a fee, fake exchange-support accounts, and fake DOJ or FBI notices. The $1.2 billion seizure will produce its own wave, because it is a large, official-sounding number. No government agency will message you privately offering to return seized crypto, and no legitimate recovery service asks for an upfront fee or a seed phrase. If you hold crypto on Binance, the only reliable source about your funds is Binance's own official channels — and Binance has said it covered user losses from its own funds.

Indian rules and taxes are unchanged. Crypto gains in India are taxed at a flat 30% plus a 4% cess, with 1% TDS on transfers, and none of that changed on 12 November. Tax note: crypto tax rules can change — the 30% rate and 1% TDS described here were current as of September 2026. Verify the latest rules before filing. The DOJ action also has no direct connection to the Enforcement Directorate's searches at CoinDCX and Delta Exchange, which are a separate Indian investigation into alleged offshore routing of customer funds — but the two stories share a theme that Indian users should note: regulators in both countries are now treating crypto crime as a law-enforcement priority, not a niche concern.

What to Watch Next

Four things will show whether 12 November was a turning point or a single headline — and none of them is a prediction.

• The US producer price index, due 13 November at 19:00 IST. The October PPI is the week's main remaining data release, and it arrives hours after this post. A hot reading would add to the pressure on risk assets that has already pushed Bitcoin below $70,000; a soft one would ease it. Either way, it is a data point, not a verdict — and it is unrelated to the DOJ announcement, which is a law-enforcement story, not a market one.
• Whether the court papers are published. The department did not post the court papers behind the $1.2 billion order. When they appear, they will show which assets and addresses are covered, and how much of the total is bitcoin, ether or stablecoins. That detail matters, because stablecoins can be frozen by their issuers while bitcoin cannot — the mix determines how much of the $1.2 billion is actually within reach.
• Whether FaceStealer leads to arrests or a rebuild. The infrastructure seizure is a disruption, not a dismantling. The operators behind Sapphire Sleet have rebuilt infrastructure before, and the FBI's own statement says the group is still active. Watch for whether the FBI names individuals, and whether copycat deepfake-call scams appear under new names — the method is now public, and it is cheap to copy.
• Whether the remaining $3.1 billion moves. About $3.11 billion of the stolen funds was still in attacker-linked addresses on 6 November, mostly in ether and bitcoin. The department says the actors are still moving funds through bridges, mixers and exchanges. If the pace of freezing slows while the pace of moving quickens, the recovery window narrows. If the opposite happens, the $1.2 billion order will be the first of several.

None of these is a signal to act on by itself. They are the facts to watch while the legal process runs its course, and they are the facts that will determine whether 12 November is remembered as the day the United States started taking the Binance loot back, or as the day it announced it would try.

The Bottom Line

On Thursday 12 November 2026, the US Department of Justice said it had obtained court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance on 29 October — about ₹11,290 crore — as part of a freeze of more than $2.7 billion that has halted roughly half of the $6.3 billion theft. The FBI attributes the theft to TraderTraitor, a North Korean military-linked operation. In the same announcement, US authorities said they had seized the cloud infrastructure behind FaceStealer, a North Korean deepfake video-call scam that has stolen more than $400 million in 18 months by impersonating trusted contacts and tricking victims into installing malware. The $1.2 billion is a slice of money already frozen, not new money and not a refund — but it is the first court-backed step toward taking the loot out of the attackers' hands for good. For Indian users, the practical points are that a familiar face on a video call is no longer proof of identity, that no one should ever install software at a caller's request, that "recovery" offers after a big theft are scams, and that the 30% tax and 1% TDS are unchanged. What happens next depends on the court papers, on whether FaceStealer's operators rebuild, and on whether the remaining $3.1 billion keeps moving — none of which can be known in advance.

Keep Learning

• FBI Blames North Korea's TraderTraitor for the Binance Hack — the formal attribution that started the law-enforcement story, and what TraderTraitor is.
• Where Is the Stolen Binance Crypto Now? — the Elliptic accounting: $3.11 billion still held, $2.85 billion frozen, and how the funds have moved since 29 October.
• How the Binance Hack Happened: Fake Job Interview, Tampered Download — the attack method behind the theft, including the fake-job-interview technique that FaceStealer echoes.