The U.S. Department of Justice is targeting $1.2 billion in stolen cryptocurrency tied to the Binance hack, and federal authorities have separately taken down infrastructure behind the FaceStealer scheme, which was used to steal as much as $400 million in crypto assets. North Korea is linked to the Binance breach, according to the facts released around the enforcement actions.
The two moves landed together, but they're not the same fight. One is about recovering a staggering sum from a state-linked heist. The other is about shutting down a tool that let criminals drain hundreds of millions more. Both point to the same uncomfortable reality: the money is still moving, and the infrastructure is still being rebuilt.
Inside the $1.2 billion claim
The DOJ's target is the Binance hack, the exchange breach that has been publicly tied to North Korean actors. The $1.2 billion figure is what prosecutors are pursuing, not necessarily what's been recovered. That distinction matters. Tracing stolen crypto through mixers, bridges, and swap services is slow work, and the gap between what's identified on-chain and what's actually seized tends to be wide. The department hasn't laid out a recovery timeline, and the facts don't say whether any of the funds have been frozen.
North Korea's involvement is the part that makes this more than a crime story. When a nation-state is the alleged beneficiary, enforcement becomes a foreign-policy problem as much as a legal one. The DOJ's pursuit of the funds is a signal that U.S. authorities aren't treating the Binance hack as a closed chapter, even with the exchange itself long past the breach.
FaceStealer: a $400 million tool, now offline
Federal authorities said they took down infrastructure used in the FaceStealer scheme, which was used to steal as much as $400 million in crypto assets. The name points to the method: face-stealing, likely referring to facial-recognition or biometric bypass techniques used to compromise accounts. The takedown is aimed at the plumbing — the servers and services that let the scheme operate — rather than at individual defendants.
That's a familiar playbook for U.S. law enforcement in crypto cases. Cutting off the infrastructure is faster than chasing every operator, and it forces the people behind the scheme to rebuild from scratch. Whether that produces arrests is a separate question. The facts don't say anyone has been charged in connection with FaceStealer.
Why the timing isn't a coincidence
Announcing a nine-figure forfeiture target alongside an infrastructure takedown is a way of showing momentum. The DOJ gets to point at both a state-linked adversary and a criminal enterprise in the same news cycle. It also puts exchanges and custody providers on notice: the funds from these schemes are still out there, and the government expects cooperation in flagging them.
For Binance, the $1.2 billion figure is an unwelcome headline. The exchange was not named as a target in this action — the DOJ is going after the stolen funds — but the hack's association with North Korea keeps the breach in the news years after it happened. That's a reputational tax the company can't easily shake.
What's still open
The facts leave several threads dangling. There's no word on how much of the $1.2 billion has been located versus merely sought, and no indication of whether the FaceStealer takedown produced any seizures of its own. The relationship between the two schemes — if any — isn't spelled out. What is clear is that federal authorities are treating both as active enforcement priorities in 2026, and the next concrete step will likely be a court filing detailing what, if anything, the government has actually recovered.
