DOJ Can Seize or Restrain Over $1.2 Billion in Stolen Binance Assets

The U.S. Department of Justice announced on November 12, 2026, that it had obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance. Combined U.S. government and private-sector efforts have frozen more than $2.7 billion following the theft of more than $6 billion in virtual assets from the exchange on or about October 29, 2026.

The announcement concerns court authorization to seize or restrain part of the frozen amount, not a completed forfeiture. The department said efforts to trace, freeze, seize and forfeit the assets remain ongoing as TraderTraitor actors continue to launder them through cryptocurrency bridges, mixers and exchanges. TraderTraitor is the FBI’s name for the specific North Korean malicious cyber activity behind the theft.

Assistant Attorney General A. Tysen Duva of the Criminal Division credited the division’s Computer Crime and Intellectual Property Section and law-enforcement partners with freezing billions of dollars before the assets moved beyond law-enforcement reach. “As the Department’s liaison to the digital asset industry, the Criminal Division quickly and efficiently used its expertise to immediately halt about half of this historic breach.”

Recovery Coordination Spans Agencies and Service Providers

The National Security Division’s National Security Cyber Section, the Criminal Division’s Computer Crime and Intellectual Property Section, the U.S. Attorney’s Office for the District of Columbia and law-enforcement partners worked with virtual asset service providers to interdict the stolen assets. The FBI’s Los Angeles Field Office, Cyber Division and Virtual Asset Unit are coordinating the bureau’s recovery work with the U.S. Secret Service and IRS Criminal Investigation.

The FBI’s October 31, 2026, alert attributed the theft to North Korea, reported observed conversions of stolen assets primarily into Ether and anticipated further laundering through DeFi and instant-swap services. The FBI, Secret Service and IRS Criminal Investigation used the alert to urge node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions involving or derived from the listed addresses.

Separate FaceStealer Infrastructure Disruption

A separate action announced by the U.S. Attorney’s Office for the Central District of California disrupted cloud-based infrastructure used in FaceStealer, a North Korean social-engineering campaign that the FBI says stole more than $400 million in cryptocurrency during the 18 months preceding the announcement. Acting under a federal warrant, the FBI seized more than 900 webcam videos of victims.

The FBI’s FaceStealer notice describes imposter video-conferencing platforms, secretly recorded webcam video and hijacked communication accounts used to lure targets into realistic fake meetings. Prerecorded or deepfake videos simulated trusted contacts before a fake technical error prompted targets to follow a link or prompt that installed malware. In several reported cases, cryptocurrency theft and account hijacking occurred several months to more than a year after the initial compromise.

The campaign targeted cryptocurrency and Web3 personnel and increasingly open-source software developers and maintainers. The FBI said the actors sought access to their devices and software repository accounts with the objective of compromising the software supply chain. That access could allow malicious code to be distributed through widely used software, potentially affecting millions of downstream users.

The two operations address different stages of North Korea’s cryptocurrency theft activity: preserving assets stolen from Binance and disrupting infrastructure used to compromise new victims. In the Binance case, the scale of final recovery remains tied to continued tracing, seizure and forfeiture work as the actors keep moving assets through bridges, mixers and exchanges.