U.S. authorities have obtained court authorisation to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, the world’s largest digital-asset exchange, in a record-breaking October cyberattack attributed by the FBI to North Korean-linked hackers. The Justice Department announced the action on Thursday, November 12, saying government agencies and private-sector partners had collectively frozen more than $2.7 billion of the stolen assets.
The announcement is a major development in the effort to trace and disrupt the proceeds of the attack, which the FBI says involved more than $6 billion in virtual assets. It does not mean that all the funds have been returned to victims: the Justice Department said the assets are subject to seizure or restraint, and further tracing, forfeiture and recovery work is continuing.
More Than $1.2 Billion Now Under Court-Authorised Restraint
The Justice Department said its National Security Division, Criminal Division, the U.S. Attorney’s Office for the District of Columbia and law-enforcement partners worked with virtual-asset service providers to identify and block funds linked to the Binance theft. Of the more than $2.7 billion frozen by public and private-sector efforts, the department has obtained court authorisation to seize or restrain more than $1.2 billion.
The distinction between a freeze, a restraint and a completed forfeiture is important. A freeze prevents assets from being moved while investigators and courts determine what can lawfully happen next. A seizure or restraint order gives authorities legal control over specified assets, but a forfeiture process may still be required before the government can transfer or return funds. The Justice Department said it would continue tracing the stolen cryptocurrency as the attackers attempt to move it through exchanges, bridges and mixing services.
The October 29 attack involved more than $6 billion in virtual assets, according to the FBI and Justice Department. The FBI has attributed the operation to a North Korean military-linked actor it calls TraderTraitor. Investigators said the stolen assets were being converted primarily into Ether and moved through services designed to make the transaction trail harder to follow.
Binance Hack Is Part Of A Wider Cybercrime Investigation
The FBI publicly attributed the Binance theft to TraderTraitor in an October 31 cyber alert. The agency said the group was converting the stolen assets mainly into Ether and urged cryptocurrency exchanges, decentralised-finance platforms, blockchain infrastructure operators and other virtual-asset providers to block transactions involving identified laundering addresses.
Binance users experienced disruption after the breach, and the exchange temporarily restricted some transactions while it worked to secure its systems. Reuters reported in early November that customers withdrew a net $4.72 billion after withdrawals resumed, while Binance said it had seen substantial inflows and that the outflows were stabilising. The exchange also pledged to cover customer losses.
The scale of the incident has raised questions about security controls at major exchanges, the risks associated with compromised employee devices and the speed at which stolen digital assets can be moved across blockchains. The attack also shows why freezing funds quickly requires cooperation among exchanges, stablecoin issuers, analytics firms, law-enforcement agencies and infrastructure providers operating in different jurisdictions.
Separate FaceStealer Scheme Allegedly Stole $400 Million
The Justice Department’s announcement also described a separate North Korean-linked operation known as FaceStealer. Officials said the scheme stole more than $400 million in cryptocurrency over the previous 18 months. The FBI said the campaign used social engineering, hijacked messaging applications and deepfake videos to deceive targets and gain access to digital assets.
Authorities announced the seizure of cloud-based infrastructure used in the FaceStealer operation and published new guidance for potential victims and companies that support open-source software development. Reuters separately reported the FBI’s estimate of more than $400 million in cryptocurrency theft linked to the campaign.
The two investigations should not be confused. TraderTraitor is the name the FBI uses for the activity it attributes to the Binance theft, while FaceStealer is a separate social-engineering campaign. The Justice Department presented both as part of a wider effort to disrupt North Korean government schemes that it says generate revenue through cybercrime.
North Korea Has Rejected Previous Accusations
North Korea has denied responsibility for the Binance theft. In an earlier statement reported by The Associated Press, Kim Yo Jong, the sister of leader Kim Jong Un, dismissed the FBI’s attribution as a provocation and rejected what she described as Washington’s repeated attempts to link the country to cybercrime. The U.S. government has maintained its assessment and cited technical intelligence and blockchain tracing in its public warnings.
The latest Justice Department announcement is an enforcement action, not a criminal trial or a judicial finding on every allegation about the perpetrators. The government’s attribution should be reported as the official U.S. assessment, while North Korea’s denial and the continuing legal process remain part of the public record.
HeadlinesXtra Analysis
The $1.2 billion restraint is important because it demonstrates that stolen cryptocurrency can be traced and blocked when public agencies and private companies share information quickly. It also shows the limits of enforcement: more than $6 billion was reportedly taken, and the amount frozen so far is only part of the total. The ability to stop funds from moving is not the same as recovering every asset or returning it to its rightful owner.
For exchanges, the case is a warning that cybersecurity must extend beyond the trading platform itself. Employee devices, software supply chains, recruitment processes and communications channels can all become entry points. Deepfake-assisted social engineering adds another layer of risk because it can exploit trust rather than only technical vulnerabilities.
The next stage will be measured by whether authorities can convert frozen assets into legally confirmed forfeitures, whether victims can be compensated, and whether the disruption makes future attacks harder. The case also reinforces the need for transparent incident reporting and stronger security standards across the digital-asset industry. Until those safeguards improve, the speed and scale of crypto theft will continue to test regulators and law enforcement across borders.
Sources And Further Reading
- U.S. Department Of Justice: Actions To Disrupt North Korea’s Massive Theft Of Cryptocurrency — official announcement of the court-authorised restraint and FaceStealer operation, November 12, 2026.
- FBI: North Korea Responsible For $6 Billion-Plus Binance Attack — October 31 cyber alert on TraderTraitor and laundering addresses.
- The Associated Press: FBI Says U.S. Has Seized $1.2 Billion Worth Of Cryptocurrency Stolen From Binance — reporting on the seizure and the separate FaceStealer scheme.
- Reuters: North Korean Hackers Steal More Than $400 Million Using Video Images, FBI Says — reporting on the FaceStealer campaign.
- Reuters: Binance Sees Outflows Stabilising After $6.3 Billion Heist — customer withdrawals and the exchange’s response.
- The Associated Press: North Korea Denies Involvement In Binance Hack — Pyongyang’s response to the U.S. attribution.
- The Guardian: Binance Resumes Customer Withdrawals After Record $6.3 Billion Hack — background on the breach and Binance’s customer-loss commitments.