US DOJ Moves to Seize Over $1.2 Billion in Crypto Stolen From Binance

Highlights:

• US authorities froze over $2.7 billion stolen from Binance, with court orders covering over $1.2 billion.
• The FBI says North Korean TraderTraitor hackers continue moving stolen funds through bridges, mixers, and crypto exchanges.
• The DOJ also seized FaceStealer infrastructure tied to more than $400 million in separate cryptocurrency thefts.

The US Department of Justice (DOJ) has secured court approval to seize or restrict more than $1.2 billion in cryptocurrency stolen during the October 29 Binance hack. Authorities and private companies have also frozen over $2.7 billion linked to the attack, which US investigators attribute to North Korean hackers. In a separate operation, federal agents seized infrastructure used by a hacking campaign called FaceStealer, which has stolen more than $400 million in cryptocurrency over the past 18 months.

In a November 12 announcement, the DOJ detailed its efforts to recover stolen digital assets and disrupt North Korean cybercrime operations targeting the cryptocurrency industry.

BREAKING: 🇺🇸 DOJ just seized $1.2 Billion in crypto stolen by North Korea, tied to the $6.3 Billion Binance hack. pic.twitter.com/AuSfssEXLP

— Ash Crypto (@AshCrypto) November 12, 2026

US Authorities Freeze Over $2.7 Billion From Binance Hack

According to the DOJ, hackers linked to North Korea’s military stole more than $6 billion in cryptocurrency from Binance on or around October 29. The FBI identified the group behind the attack as TraderTraitor. Following the breach, US law enforcement agencies worked with cryptocurrency service providers to track and block the movement of stolen funds.

These efforts helped freeze more than $2.7 billion, while the DOJ secured court authorization to seize or restrain over $1.2 billion of that amount. The $1.2 billion is part of the larger frozen total, not an additional recovery. Assistant Attorney General A. Tysen Duva credited investigators and industry partners for “immediately freezing billions of dollars’ worth of stolen Binance digital assets.”

However, authorities have not recovered all the stolen cryptocurrency. Investigators continue tracking funds as the attackers move assets between different blockchain networks and services.

North Korea has denied involvement in the Binance hack. In a November 3 statement carried by state news agency KCNA, Kim Yo Jong, sister of North Korean leader Kim Jong Un, rejected the FBI’s accusations as “absurd rhetoric.” She accused Washington of unfairly linking North Korea to major cybercrime incidents and described the allegations as a political provocation.

FBI Tracks Stolen Binance Funds Across Crypto Platforms

The FBI has also taken steps to prevent the hackers from laundering the remaining assets. In an October 31 cyber alert, the agency blamed TraderTraitor for the Binance attack and published cryptocurrency addresses associated with the stolen funds.

Investigators found that the hackers had been converting stolen assets primarily into Ether (ETH). They warned that the group could continue moving funds through decentralized finance platforms, instant exchanges, and other services. The FBI urged cryptocurrency companies, blockchain analytics firms, and network operators to block transactions involving the identified addresses.

The US Secret Service and Internal Revenue Service Criminal Investigation division are also helping trace the funds. The DOJ said its efforts to freeze, seize, and recover the stolen cryptocurrency remain ongoing.

Thank you, @SecretService, and all the agencies and industry partners involved. You acted within minutes to help track and freeze stolen funds, and the work continues.

Your speed, expertise, and dedication helped contain the damage and reduce the risk of potential ripple effects… https://t.co/H4rRqXelV9

— CZ 🔶 BNB (@cz_binance) November 1, 2026

DOJ Seizes FaceStealer Infrastructure Linked to $400 Million Crypto Theft

Alongside the Binance investigation, the DOJ announced action against FaceStealer, a separate North Korean hacking campaign targeting cryptocurrency holders and Web3 professionals. According to the department, FaceStealer operators have stolen more than $400 million in cryptocurrency over the past 18 months. 

The hackers used compromised accounts to invite victims into fake video meetings. During these calls, they played prerecorded footage of familiar contacts or used AI-generated deepfake videos to gain their targets’ trust. They then introduced a fake technical problem and encouraged victims to install software to fix it. Instead, the download installed malware that gave attackers access to their computers. In some cases, the hackers waited months before stealing cryptocurrency or taking control of victims’ online accounts.

The DOJ confirmed that federal agents seized cloud infrastructure supporting the operation. The FBI also recovered more than 900 webcam recordings of FaceStealer victims under a federal warrant.

Investigators warned that the group had also started targeting open-source software developers, raising concerns about further attacks through compromised software projects. The agency has published additional guidance on identifying and avoiding these attacks through its FaceStealer information page.