The US Justice Department just made its biggest move yet in the aftermath of the Binance hack, and it landed on a day when the whole market was bleeding. Here is what I think matters.
What Happened
On Thursday the DOJ said it has received court authority to seize more than $1.2 billion in crypto frozen after the October 29 theft at Binance. According to CoinDesk, that is part of a wider effort by US authorities and private companies that has frozen more than $2.7 billion of the more than $6 billion stolen. The FBI attributes the attack to a North Korean military-linked hacking operation known as TraderTraitor.
In a separate action, federal agents seized cloud infrastructure used in a campaign called FaceStealer. The FBI says it has stolen more than $400 million in crypto over the past 18 months, and it seized more than 900 webcam videos collected by the attackers.
Background
FaceStealer is social engineering at its most uncomfortable. Victims get invited to a fake video meeting that looks like Zoom or Teams. The attackers impersonate a trusted contact, using secretly recorded webcam footage from earlier victims and, increasingly, deepfake video. Then they claim there is a technical problem and tell the target to install software or run a command. That command is the malware.
The FBI also warned that developers who maintain widely used open-source software have been targeted. Compromise one maintainer and you may get a door into everything built on top of their code.
Why It Matters
Two things stand out to me.
First, the money is not just being traced, it is being legally taken. Freezing funds is one step. A court-backed seizure is the step that can lead to actual return. With over $2.7 billion frozen out of $6 billion plus, the recovery rate in this case is already far above what we usually see after a major hack.
Second, the attack method is the real lesson. Smart contracts and cold storage are not the weak point here. A convincing face on a video call is. If a "colleague" asks you to run a command to fix your audio, that is the moment to stop.
Market Impact
The timing is awkward for sentiment. CoinDesk reports Bitcoin fell below $70,000 early Friday, its lowest level since August 19, while Ether dropped below $2,000 for the first time since August. XRP is trading close to $1 and Solana is below $80.
Exchanges liquidated more than $1.3 billion in futures positions over 24 hours, including $677 million tied to Bitcoin, according to Coinglass. CoinDesk linked the selloff to reports of renewed military escalation in the Middle East. The DOJ news is not what is moving prices, but it does show that enforcement is catching up faster than many expected.
What to Watch Next
Watch how much of the $1.2 billion is actually forfeited and returned, and how fast. Watch whether the remaining stolen funds, still moving through bridges, mixers and exchanges, get frozen too. And watch whether more projects and exchanges tighten rules around video-call verification and developer access.
My take: the hackers are getting more sophisticated, but so is the response. Security habits are now as important as any trade.
What is your own rule for verifying a video call before you run anything on your machine? Share it below.