FBI Seizes More Than $1.2 Billion Stolen in Binance Hack as DOJ Moves Against North Korea's Crypto Thieves

Federal investigators have clawed back more than $1.2 billion of the cryptocurrency stolen from Binance last month, the FBI said Thursday, as the Justice Department announced a broader crackdown on North Korea's cyber theft operations ^[1][2][3].

The Biggest Crypto Heist on Record

The theft from Binance, which the AP describes as the world's largest crypto exchange, totaled about $6.3 billion and is "regarded as the biggest crypto heist in history," the AP reported ^[1]. The FBI has previously attributed the attack to a North Korean hacking group known as TraderTraitor ^[1].

Government agencies and private companies have together frozen more than $2.7 billion of the stolen funds, and the Justice Department has obtained court authorization to seize or restrain more than $1.2 billion of that total, according to the AP ^[1]. In cases like this, the government files a forfeiture claim with a judge, who then decides who has a legitimate claim to the recovered money ^[1].

Binance, for its part, has finished covering the $6.3 billion in stolen customer tokens, Bloomberg reported ^[4], meaning the exchange's customers have been made whole even as investigators chase the thieves. The Washington Examiner, describing the freeze, credited federal authorities with locking up more than $2.7 billion ^[2]; the AP said that figure reflects work by both government and private companies ^[1].

A Wider Campaign Against Pyongyang's Hackers

The Washington Examiner reported that the Justice Department's effort includes recovering billions of dollars stolen from Binance and dismantling a separate hacking operation that has targeted cryptocurrency holders and software developers ^[2].

That separate operation got a name on Thursday. The FBI blamed North Korea for a social-engineering scheme it calls "FaceStealer," which officials say stole $400 million over the last 18 months by combining the hijacking of popular messaging apps with recorded deepfake videos, the AP reported ^[1]. The scheme shows how quickly criminals are turning new technology into new ways to steal from ordinary people.

U.S. officials have repeatedly accused North Korea of using cyber schemes to raise money for its regime, including its illicit weapons program, according to the AP ^[1]. That is what makes these thefts a national security matter, not just a financial one: every stolen dollar that reaches Pyongyang can help pay for missiles and nuclear weapons aimed at America and its allies.

Why This Matters

Kim Jong Un's regime is under some of the heaviest sanctions in the world, and it has turned to hacking as a way around them. A heist of this size, if it had gone unanswered, would have been a windfall for one of the most dangerous governments on earth.

Related Ireland's Russian-Owned Refinery Keeps Shipping Alumina to Putin's Smelters as Pressure Builds in Dublin

The response so far is a credit to the investigators who traced the money across the blockchain and worked with exchanges and other companies to freeze it ^[1]. Seizing more than $1.2 billion is a significant blow, though billions more remain outside the government's reach ^[1]. The cooperation between law enforcement and private companies in freezing stolen funds is a model worth building on: crypto markets are safer when exchanges and investigators work together against hostile regimes ^[1][2].

There is also a lesson for the millions of Americans who now hold digital assets. The FaceStealer scheme worked by exploiting trust: a familiar messaging account, a convincing video ^[1]. Investors should treat any unexpected request for money or access with suspicion, even when it seems to come from someone they know.

What Comes Next

The seized funds will move through federal court, where a judge will decide who has a rightful claim to them ^[1]. The Justice Department's broader push against North Korean crypto theft is just getting started ^[2]. And the hunt for the rest of the stolen billions continues ^[1][3][5].

For a regime that has treated American exchanges and investors as an ATM, Thursday's announcement sends a clear message: the money can be traced, and the United States will come after it.