The FBI "recovered" $1.2 billion of the crypto North Korea stole from Binance, headlines said Friday. The Justice Department's own release uses more careful words: court-authorized "seizure and restraint" of more than $1.2 billion, out of a theft it puts at more than $6 billion. Kim Jong Un's hackers took a real hit this week. Here is how big it actually is.

What did the Justice Department actually announce?

On Thursday, Nov. 12, DOJ announced two separate actions against North Korea's crypto theft machine. The first is the Binance money. The second is the takedown of a video-call hacking scheme the FBI calls "FaceStealer," which we cover below.

On Binance, the release says that "on or about Oct. 29, members of the North Korean military, referred to by the FBI as 'TraderTraitor' stole more than $6 billion worth of virtual assets." It then gives two numbers that headlines have blended together. Government and private-sector efforts "have resulted in the freeze of more than $2.7 billion," and DOJ has "obtained court-authorization to seize or restrain in excess of $1.2 billion of that amount."

The tone from the top was combative, and fairly so. "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," said M. Scott Proctor, the No. 2 official in DOJ's National Security Division. "Today's announcement shows that America will fight back."

Is "recovered" the right word?

Not yet. CBS News ran the AP story under the headline "FBI says it's recovered $1.2 billion." The body of that same story explains that the government typically files a forfeiture claim and a judge then decides who has a legitimate claim to the funds. Neither step is described as finished in the DOJ release.

"Restrain" matters too. Restrained assets are locked in place so nobody can move them, which is not the same as the government holding them. DOJ does not split the $1.2 billion between seized and restrained, and it names no court, case number, or defendant. U.S. Attorney Jeanine Pirro of D.C., quoted in the same release, went further than its text, saying her office was "seizing more than $1.2 billion of their stolen assets."

The release itself says the work is far from done: "Efforts to trace, freeze, seize, and forfeit the stolen virtual assets are ongoing, as TraderTraitor actors continue to launder such assets through various cryptocurrency bridges, mixers, and exchanges."

How much is still in North Korea's hands?

Do the subtraction on DOJ's own numbers. More than $6 billion stolen, minus more than $2.7 billion frozen, leaves somewhere above $3 billion that nobody has stopped. Wire reports put the theft at about $6.3 billion, which would make the unfrozen share roughly $3.6 billion.

Assistant Attorney General A. Tysen Duva said his Criminal Division helped "immediately halt about half of this historic breach." Measured by DOJ's frozen figure, that is closer to 43% of $6.3 billion. Close enough to round, but the $1.2 billion in court orders is under a fifth of the haul.

The scale is staggering. The Record reported that the same TraderTraitor group took $1.4 billion from Bybit in 2025, making Binance about four and a half times bigger. It also cited Chainalysis crediting North Korea with nearly 90% of 2026's crypto hack losses, and former FBI deputy director Cynthia Kaiser warning that about half the stolen money has moved so many times that recovery will be very hard.

Who lost the money?

Not Binance's customers, at least by the company's account. Co-CEO Richard Teng said on Oct. 31 that Binance had "replenished 90 percent of the stolen assets" using company funds and was "committed to covering the remaining 10 percent," NTD reported. "Our users will not bear the financial impact of this incident," he added.

That means any forfeited money is likely to end up contested between the government and Binance itself, not handed back to ordinary account holders. How the break-in started is also instructive. Binance has said it began with a fake job interview that compromised an engineer's laptop, Fox Business reported. North Korea does not need to crack vaults when it can trick the people holding the keys.

What is FaceStealer, and could it reach you?

This is the part of Thursday's news with the most practical value. The FBI bulletin says North Korean hackers stole more than $400 million over 18 months by hijacking a victim's Telegram or similar account, inviting that victim's contacts to a fake Zoom or Teams call, and playing secretly recorded webcam video of the victim to make the call look real. Then comes a fake audio problem and a "fix" that installs malware.

The bulletin says the hackers have also begun using "super intelligence (SI) to generate deepfake videos" of well-known crypto figures. Worse, they used the trick earlier this year on the maintainer of an open-source JavaScript library that "receives tens of millions of downloads per week," and slipped malicious code into it before it was caught.

The FBI's advice is simple. Join meetings through the official app with an invite code, keep your webcam off until you can see and hear the person who invited you, never paste code into your computer to "fix" a call, and confirm unusual meeting requests by phone or text. The Bureau has set up a resource page at fbi.gov/facestealer.

So is this a win?

Yes, and a real one. Locking up more than a billion dollars of a hostile regime's loot within two weeks is fast work, and seizing 900 stolen webcam videos takes away a weapon North Korea was actively using against Americans. Pyongyang uses this money for its weapons program, by DOJ's own account.

But the honest scoreboard reads like this: about $1.2 billion under court orders, about $2.7 billion frozen, more than $3 billion still moving through mixers, no defendant named, and no judge yet ruling on who keeps what. The number to watch is the forfeiture filing. When DOJ actually asks a court to transfer the money, the word "recovered" will finally fit.

Top photo: Alexei Nikolsky, Russian Presidential Press and Information Office, via Wikimedia Commons, CC BY 4.0.