U.S. Justice Department Says It Has Frozen About $2.7 Billion in Binance-Stolen Assets in Joint Action With Stablecoin Issuers
Bloomberg reported on November 12 that the U.S. Department of Justice said it had worked jointly with the two major stablecoin issuers, Tether and Circle, to freeze or secure about $2.7 billion, nearly half of the more than $6 billion in assets stolen from the Binance exchange on October 29. The Justice Department has obtained court authorization to seize or restrict about $1.2 billion of that amount.
On the same day, the FBI’s cyber division and the Justice Department announced that they had disrupted the FaceStealer social engineering infrastructure used by North Korean hackers. The method impersonated video-conferencing platforms such as Zoom, Microsoft Teams, and Google Meet, using pre-recorded webcam videos and deepfakes to诱使 targets to install malware, and it stole more than $400 million in crypto assets over the past 18 months. Acting on warrants, the FBI has seized more than 900 victim webcam videos and warned that the group is intensifying supply-chain attacks against open-source software developers. The Binance theft was carried out by a North Korean military hacking group the FBI calls TraderTraitor, and is a separate operation from FaceStealer.
Original sources:
Title: US Details $2.7 Billion Freeze After North Korea’s Binance Hack
Publisher: Bloomberg
Publication date: 2026-11-12
URL: news.bloomberglaw.com/privacy-and-data-security/us-details-2-7-billion-freeze-after-north-koreas-binance-hack
Source nature: media report (relaying Justice Department statements)
Verification: This report was actually read in this instance, and cross-checked against the U.S. Department of Justice’s official November 12 announcement; verification date 2026-11-12
Supporting content: Supports the statement that the Justice Department, together with the two major stablecoin issuers, froze about $2.7 billion, nearly half of the stolen assets; the official announcement adds the court-authorized seizure of $1.2 billion, the specific FaceStealer tactics, and the $400 million loss figure
ABAB AI Insight
The freeze amount mainly came from the technical ability of stablecoin issuers to blacklist addresses, combined with law enforcement tracing and court authorization. Of the $2.7 billion, $1.2 billion has entered judicial seizure proceedings, while the rest is still being tracked.
FaceStealer and the large Binance theft were parallel operations: the former relied on social engineering and identity impersonation, while the latter was attributed to TraderTraitor. Both point to North Korea-related cyber activity, but their methods and target groups were different.
Stablecoin freezes can temporarily limit the movement of funds, but subsequent laundering through cross-chain bridges, mixers, and exchanges is still ongoing. The supply-chain attack risk points to open-source maintainers at a more upstream stage.
ABAB News · Cognitive Law
Stablecoin issuers’ address-freezing capability allows fund preservation after large-scale theft to begin even before judicial proceedings.
Social engineering and large-scale exchange intrusions can coexist, with the former relying on identity impersonation and the latter on obtaining system privileges.