US freezes billions stolen by North Korean hackers in Binance heist

US authorities have frozen billions in cryptocurrency stolen by North Korean hackers, while dismantling a separate operation that used deepfake video calls to steal hundreds of millions more.

The US Justice Department has announced a major crackdown on North Korea's cryptocurrency theft operations, securing court authorization to seize or restrain more than $1.2 billion in digital assets stolen from Binance in October.

The Nov. 12 announcement also reveals the disruption of a separate North Korean hacking campaign that used fake video meetings, stolen accounts and AI-generated deepfakes to steal more than $400 million in cryptocurrency.

The Justice Department said US authorities and private-sector partners have collectively frozen more than $2.7 billion of the funds stolen in the Binance attack, described as the largest cryptocurrency heist on record.

Key points

• US authorities have secured court orders to seize or restrain more than $1.2 billion stolen from Binance
• Government agencies and private companies have frozen over $2.7 billion of the stolen cryptocurrency
• The FBI also disrupted FaceStealer, a North Korean operation linked to more than $400 million in cryptocurrency theft
• Hackers used deepfake video calls, compromised accounts and fake technical problems to trick victims into installing malware

Billions frozen after record-breaking Binance heist

The announcement comes after hackers stole an estimated $6.3 billion in cryptocurrency in an Oct. 29 attack on Binance.

As Bitdefender reported earlier, the FBI attributed the unprecedented theft to TraderTraitor, a North Korean hacking operation linked to the country's military.

Investigators have been working with cryptocurrency exchanges, blockchain intelligence companies and other financial service providers to trace and intercept the stolen assets before they disappear into the cryptocurrency ecosystem.

The effort has so far resulted in the freezing of more than $2.7 billion, with the Justice Department obtaining court authorization to seize or restrain over $1.2 billion of that amount.

Freezing cryptocurrency prevents it from being moved. Seizure and forfeiture involve additional legal steps to establish government control and determine whether assets can eventually be returned to their rightful owners.

The operation is far from over. According to investigators, TraderTraitor is still trying to launder the stolen funds through cryptocurrency bridges, mixers and exchanges, further complicating recovery.

In an Oct. 31 advisory, the FBI warned that the hackers were converting stolen assets primarily into Ether before moving them through decentralized finance platforms and instant-swap services.

Authorities urged cryptocurrency service providers to identify and block transactions associated with the attackers' wallets.

Fake video calls help North Korean hackers steal another $400 million

Alongside the Binance recovery effort, the Justice Department announced the disruption of a separate North Korean hacking operation, dubbed FaceStealer.

The campaign has allegedly generated more than $400 million in stolen cryptocurrency over the past 18 months by exploiting the trust people place in familiar faces and online meetings.

The hackers typically begin by compromising someone's communications accounts, then use them to invite the victim's contacts to video meetings.

Once the target joins, the attackers play prerecorded webcam footage of someone the victim knows, creating the impression that a trusted contact is participating in the call.

In other cases, they use AI-generated deepfake videos impersonating influential figures in the cryptocurrency and Web3 industries.

The deception is designed to make the meeting look legitimate long enough for the attackers to introduce a fabricated technical problem.

Victims might be told their microphone isn't working, for example, and instructed to follow a link or perform a supposed troubleshooting step.

Instead of fixing the problem, the instructions install malware that gives the attackers access to the victim's computer.

From there, the hackers can steal cryptocurrency, hijack communications accounts or exploit access to other systems.

Investigators say some victims had cryptocurrency stolen months or even more than a year after the initial compromise.

Hackers also target open-source software developers

The FaceStealer campaign extends beyond cryptocurrency investors and traders.

According to the FBI, North Korean operatives have also been targeting developers and maintainers of open-source software, apparently seeking access to their computers and software repository accounts.

Such access could let attackers tamper with software distributed to other users, potentially turning a single compromised developer into an entry point for a much larger supply-chain attack.

As part of the investigation, federal agents seized cloud infrastructure supporting the operation and obtained more than 900 webcam recordings of victims.

The FBI has also established a dedicated FaceStealer information hub to explain the threat and help potential victims recognize the attack.

Another warning for cryptocurrency users

The announcement comes amid heightened security concerns surrounding Binance.

Earlier this week, the exchange warned iPhone users about a security flaw that could allow malicious applications to access sensitive information stored by other apps, potentially exposing cryptocurrency wallet recovery phrases, private keys and login credentials.

The vulnerability, known as worse_query, affects Apple's operating system rather than Binance itself.

There is no evidence connecting the iOS flaw to the October Binance heist or the FaceStealer operation.

How to protect your crypto wallet

Cryptocurrency users, developers and anyone handling valuable digital assets should take several precautions:

• Verify unexpected meeting invitations: If a contact suddenly asks you to join a video call involving money, cryptocurrency or technical troubleshooting, confirm the invitation through a separate channel
• Never install software to fix an unexpected meeting error: Be wary of requests to download programs, run commands or change security settings to get your microphone or camera working
• Protect cryptocurrency wallet credentials: Keep recovery phrases and private keys offline, and never share them with supposed support representatives
• Secure your accounts: Use strong, unique passwords and phishing-resistant multifactor authentication wherever possible
• Keep devices updated: Install operating system and application security updates, and use reputable security software to help detect malicious downloads
• Act quickly if you suspect a compromise: Disconnect the affected device, secure accounts from a trusted device and move cryptocurrency to a new wallet if its private keys or recovery phrase may have been exposed

Be particularly cautious of messages offering to help recover funds stolen in the Binance breach. Criminals often exploit major cryptocurrency thefts by impersonating exchanges, investigators or recovery services to steal even more money.

If you receive a suspicious investment offer, support message or cryptocurrency-related link, Bitdefender Scamio can help you assess whether you're dealing with a potential scam before you respond.

For additional protection, Bitdefender security solutions can help detect malicious downloads, phishing websites, and other threats that criminals use to compromise cryptocurrency users.

On topic:

FBI blames North Korea for $6.3 billion Binance crypto heist

Binance warns iPhone users of security flaw that could expose crypto wallets

Europol busts investment scam network spanning 50 countries, seizes over 100 servers

FAQ: North Korea's Binance cryptocurrency heist

How much cryptocurrency did North Korean hackers steal from Binance?

North Korean hackers stole an estimated $6.3 billion in cryptocurrency from Binance in October 2026 in what authorities describe as the largest cryptocurrency heist ever. The FBI attributed the attack to TraderTraitor, a hacking operation linked to North Korea.

How much of the stolen Binance cryptocurrency has been recovered?

US authorities and private-sector partners have frozen more than $2.7 billion in cryptocurrency linked to the Binance attack. The Justice Department has obtained court authorization to seize or restrain more than $1.2 billion of those assets. However, frozen or restrained funds are not necessarily recovered funds, and further legal proceedings may be required before assets can be returned.

Why is North Korea stealing cryptocurrency?

US authorities say North Korea uses cryptocurrency theft to generate revenue for the regime and help finance its weapons programs, including the development of nuclear weapons and ballistic missiles. Cryptocurrency exchanges and digital asset companies are attractive targets because they handle large volumes of highly valued assets.

What is TraderTraitor?

TraderTraitor is a North Korean cybercrime operation associated with attacks on cryptocurrency companies and financial platforms. The group uses social engineering, malicious software and other techniques to compromise organizations and steal digital assets. The FBI linked TraderTraitor to the October 2026 Binance heist.

What is FaceStealer, and how does it work?

FaceStealer is a separate North Korean hacking operation that uses compromised communications accounts, prerecorded webcam footage and AI-generated deepfakes to impersonate trusted contacts during video meetings. Attackers trick victims into installing malware under the pretext of fixing technical problems. The operation has been linked to more than $400 million in cryptocurrency theft over approximately 18 months.

Are Binance users' cryptocurrency wallets at risk?

The October Binance heist does not automatically mean that individual customers' wallets or private keys have been compromised. However, cryptocurrency users are frequent targets of phishing, malicious applications, account takeovers and fraudulent recovery services. Binance also recently warned about an iOS vulnerability that could expose sensitive wallet information, although no connection has been established between that flaw and the October attack.

Can stolen cryptocurrency be traced and recovered?

Yes. Transactions on many public blockchains can be traced, allowing investigators to follow stolen assets as they move between wallets and services. However, criminals use cryptocurrency mixers, cross-chain bridges and other laundering techniques to complicate investigations. Even when authorities identify and freeze stolen funds, recovering and returning them can require lengthy legal proceedings.

How can cryptocurrency users protect themselves from North Korean hackers?

Users should enable phishing-resistant multifactor authentication, keep devices updated, use reputable security software and protect wallet recovery phrases and private keys. They should also verify unexpected video meeting invitations, avoid installing software recommended by unverified contacts and refrain from executing unfamiliar commands to resolve supposed technical problems. Hardware wallets can provide additional protection for long-term cryptocurrency holdings, as long as recovery phrases are secure.