Nearly Half of the $6 Billion Binance Heist Is Frozen, the Justice Department Says

More than $2.7 billion of the crypto that North Korean hackers took from Binance has now been frozen, the U.S. Justice Department said, roughly two weeks after one of the largest crypto hack cases on record.

The department announced on Nov. 12 that it had already won court authorization to seize or restrain more than $1.2 billion of that frozen amount. On the same day, it said the FBI had taken down cloud servers behind a separate North Korean scheme the bureau calls FaceStealer.

The totals behind both cases are large. According to the department, members of North Korea’s military stole more than $6 billion in virtual assets from Binance on or about Oct. 29, and FaceStealer has drained more than $400 million from victims over the past 18 months.

We believe the speed of the freeze is the real headline. Stolen funds that move across public blockchains leave a trail, and this case shows how fast that trail can be followed once law enforcement and the industry work together.

About Half of a Historic Breach, Halted

The Justice Department credited joint work between federal prosecutors, the FBI and virtual asset service providers, the exchanges and other firms that can block suspect transfers.

“The Criminal Division quickly and efficiently used its expertise to immediately halt about half of this historic breach,” said Assistant Attorney General A. Tysen Duva of the department’s Criminal Division.

U.S. Attorney Jeanine Ferris Pirro for the District of Columbia said the team “worked together to freeze this massive criminal fraud in its tracks.”

The work is not finished. The department said the hackers, a group the FBI calls TraderTraitor, are still trying to launder the remaining funds through crypto bridges, mixers and exchanges.

Earlier this month, the FBI, the U.S. Secret Service and IRS Criminal Investigation issued a Cyber Alert that named North Korea as the culprit and urged service providers to block transactions linked to the hackers’ laundering addresses.

We have tracked some of those laundering tactics already, including the home-made memecoins used to move stolen NEAR. Each new trick still leaves records on a public ledger.

How FaceStealer Used Deepfakes on Video Calls

The second case shows how much North Korean hackers now rely on deception rather than code alone.

According to the department, victims received invitations to video meetings sent from accounts the hackers had stolen from earlier victims. Once a target joined, the hackers recorded the target’s webcam and played prerecorded clips of earlier victims the target already knew, making it look as if trusted contacts were on the call.

The hackers also used what the department called super intelligence to build deepfake videos of well-known figures in crypto and Web3, the department said.

The trap was then sprung with a fake technical problem. A target would be told, for example, that nobody could hear them, and would be handed a link or prompt to fix it. That “fix” quietly installed malware.

In several cases, the department said, the theft of crypto and the hijacking of communication accounts came months, and in some cases more than a year, after the first compromise.

Why North Korea Hackers Now Target Open-Source Developers

The FBI said FaceStealer is no longer aimed only at crypto holders. Its operators have increasingly gone after people who build and maintain open-source software, trying to reach their devices and the code repositories they control.

The department described that targeting as apparently designed to enable software supply-chain attacks, where one compromised developer can expose many downstream users.

The Justice Department listed the groups behind the scheme under several public names, including Sapphire Sleet, BlueNoroff, APT38, CryptoCore and Stardust Chollima. Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims.

“If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” said Patrick Grandy, Assistant Director in Charge of the FBI’s Los Angeles Field Office.

Lessons From the Latest Crypto Hack Cases

For everyday Bitcoin holders, the practical takeaway is simple. Both cases targeted companies and people. Neither involved a flaw in Bitcoin’s underlying network.

The FBI has published a FaceStealer resource page with protection tips and steps for victims. Treat any surprise “fix this audio problem” link during a video call as a red flag, even when the call appears to include people you know.

Keeping long-term savings in self-custody, on a hardware wallet that never touches meeting software, removes a large share of this risk. The debate over self-custody has only grown since the Binance breach, as we noted when Ledger’s chief executive warned that “everybody will be hacked.”

What Comes Next for the Frozen Funds

A freeze is not the same as a final recovery. The department said its work to trace, freeze, seize and forfeit the stolen assets is ongoing, and forfeiture usually requires further court steps before funds can be returned.

Still, the numbers mark a sharp change from earlier eras of crypto crime, when stolen coins often vanished for good. In this case, more than $2.7 billion was stopped within roughly two weeks of the theft.

We believe that is a strong signal for the industry. Every transaction on a public blockchain stays visible, and as exchanges, analysts and investigators get faster at reading that record, crime pays less and trust in crypto builds.