The DOJ is chasing $1.2 billion, but coverage stopped at $400 million
The Justice Department secured court approval to seize $1.2 billion stolen from Binance by North Korea's TraderTraitor hacking group, while simultaneously dismantling a deepfake social engineering scheme called FaceStealer that netted an additional $400 million over 18 months. Three outlets covered it. Two of them led with the smaller number. The $1.2 billion forfeiture action — the actual legal milestone — got buried under the more digestible FBI headline. The number that matters here is twelve, not four.
North Korea's Binance hack faces US crackdown as DOJ targets $1.2 billion in stolen crypto
2 sources · hover a dot to see coverage
What happened
The Justice Department obtained court approval to seize approximately $1.2 billion in cryptocurrency stolen from Binance by North Korea's TraderTraitor hacking group, according to reporting published November 12, 2026. Separately, the FBI announced it had disrupted infrastructure tied to FaceStealer, a North Korean social engineering scheme that used deepfakes to steal more than $400 million in crypto assets over the past 18 months. Federal authorities described both actions as part of a broader crackdown on North Korean state-sponsored crypto theft. The DOJ and FBI actions are distinct but related: one targets laundered proceeds from a major exchange hack, the other dismantles an active fraud operation. Three outlets covered the story. The split between which number each outlet led with tells you most of what you need to know about the coverage.
Crypto outlets ran the bigger number; The Hill ran the smaller one
The Block and CoinDesk both named the $1.2 billion DOJ seizure action in their headlines and treated the Binance hack as the primary story. The Block's framing was the most complete: 'DOJ moves to seize $1.2 billion from Binance hack, disrupts North Korean deepfake scheme' treats the forfeiture as the lede and FaceStealer as the secondary action. CoinDesk matched that structure. The Hill, the only general-interest outlet in the coverage, led with the FBI's $400 million FaceStealer announcement and did not mention the $1.2 billion seizure in its headline at all. Readers of The Hill's piece got the FBI story. They got a partial picture of the DOJ story.
What one side told you that the other didn't
The $1.2 billion action is the news. One outlet missed it.
The DOJ's court-approved seizure of $1.2 billion is a distinct legal action from the FBI's FaceStealer disruption, and it is the larger, more consequential development. The Hill's headline and framing centered entirely on the $400 million FaceStealer figure, which is the FBI's number, not the DOJ's. The Block and CoinDesk both named $1.2 billion up top. A reader who only saw The Hill's coverage would know North Korean hackers stole $400 million. They would not know the U.S. government just moved to claw back three times that amount.
TraderTraitor, North Korea's named hacking unit, appears in one headline.
The Block named TraderTraitor — the specific North Korean state-sponsored group attributed to the Binance hack — in its reporting. CoinDesk referenced the group in its framing. The Hill's coverage attributed the theft to 'North Korean hackers' generically. TraderTraitor has been sanctioned by the U.S. Treasury and is a named, tracked threat actor. The difference between 'North Korean hackers' and 'TraderTraitor' is the difference between a weather report and a named storm. One tells you something actionable about attribution and prior history.
What to watch
The DOJ's $1.2 billion seizure action will require follow-on proceedings to execute — watch for whether any of the targeted wallets are successfully frozen or whether North Korea's laundering infrastructure moves faster than the court calendar. If Binance or any named exchange is compelled to cooperate with the seizure order in the next 30 days, that cooperation decision will be the story general-interest outlets actually cover.
See how outlets across the political spectrum framed this differently — and what each side left out.