---
title: DOJ: court-authorized seizure or restraint of $1.2B+ stolen from Binance, and FaceStealer deepfake-meeting infrastructure seized | ctxsec
url: https://ctxsec.com/items/doj-seizes-1-2b-binance-theft-tradertraitor-facestealer-infrastructure-disrupted
description: "The Justice Department says US government and private-sector efforts have frozen more than $2.7 billion of the more than $6 billion stolen from Binance on or about Oct 29 by North Korea's TraderTraitor, and DOJ has court authorization to seize or restrain more than $1.2 billion of it; tracing continues as the actors launder through bridges, mixers and exchanges. Separately, the Central District of California disrupted cloud infrastructure behind 'FaceStealer', a North Korean scheme (Sapphire Sleet / UNC1069 / BlueNoroff / APT38) that used fake video meetings, recorded webcam video of earlier victims and deepfakes to steal more than $400 million in 18 months, increasingly aimed at open-source maintainers. The FBI seized over 900 victim webcam videos and published a FLASH and a resource page."
status: "official (DOJ Office of Public Affairs, Nov 12, 2026)"
published: 2026-11-12
---

> The Justice Department says US government and private-sector efforts have frozen more than $2.7 billion of the more than $6 billion stolen from Binance on or about Oct 29 by North Korea's TraderTraitor, and DOJ has court authorization to seize or restrain more than $1.2 billion of it; tracing continues as the actors launder through bridges, mixers and exchanges. Separately, the Central District of California disrupted cloud infrastructure behind 'FaceStealer', a North Korean scheme (Sapphire Sleet / UNC1069 / BlueNoroff / APT38) that used fake video meetings, recorded webcam video of earlier victims and deepfakes to steal more than $400 million in 18 months, increasingly aimed at open-source maintainers. The FBI seized over 900 victim webcam videos and published a FLASH and a resource page.

[← Cybersecurity News](/news) · [markdown](/items/doj-seizes-1-2b-binance-theft-tradertraitor-facestealer-infrastructure-disrupted.md)

official (DOJ Office of Public Affairs, Nov 12, 2026)

2026-11-12 7:40 PM ET

### DOJ: court-authorized seizure or restraint of $1.2B+ stolen from Binance, and FaceStealer deepfake-meeting infrastructure seized

- **Why it matters:** DOJ says FaceStealer targeting of open-source developers appears aimed at software supply-chain attacks.
- **Read:** the FBI FLASH via fbi.gov/facestealer for protection steps and victim guidance.
- **Context:** see earlier items on the Binance theft and the FBI's TraderTraitor attribution.

Sources: [DOJ: Justice Department Announces Actions to Disrupt North Korea's Massive Theft of Cryptocurrency (Nov 12, 2026)](https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency) · [FBI: FaceStealer Cryptocurrency Theft Scheme](https://www.fbi.gov/facestealer)