The U.S. Department of Justice (DOJ) has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance by North Korean military hackers. The enforcement action, announced on November 12, targets funds tied to what officials describe as a $6.3 billion cyberattack and forms part of a broader strategy to disrupt the regime's cryptocurrency-theft operations (Justice Department announcement).

Since the October 29 attack, the U.S. government, working together with partners, has frozen more than $2.7 billion of the stolen cryptocurrency. The amount covered by the DOJ's court order constitutes almost half of the frozen stolen funds, and investigations to trace the remainder are still ongoing. The response has moved quickly: the breach occurred on October 29, the FBI issued its attribution alert on October 31, and the court-authorized action followed on November 12. The FBI has attributed the attack to TraderTraitor (FBI cyber alert).

The November 12 action also targets a second North Korean-linked scheme, FaceStealer, which has stolen more than $400 million in cryptocurrency over 18 months through pre-recorded videos and deepfake technology.

Department of Justice Targets North Korean Crypto Theft

The DOJ claims that the DPRK uses cryptocurrency theft as a means of generating money to fund its government and illicit weaponry. The latest set of actions involved multiple agencies, including the National Security Division, the Criminal Division, the FBI, the U.S. Secret Service, and IRS Criminal Investigation.

The US Department of Justice seized infrastructure linked to North Korea's $400 million FaceStealer crypto theft scheme and froze over $1.2 billion in cryptocurrency stolen from Binance. #Crypto #Binance — Lego (@Doctor_Stefan) November 12, 2026

Source: X post

The involvement of virtual asset service providers made it possible for authorities to freeze billions of dollars before the money left their jurisdiction. For the crypto industry, that detail shows how enforcement outcomes can turn on service-provider cooperation: funds held at an exchange or custody platform can be immobilized before they are dispersed. Assistant Attorney General A. Tysen Duva explained that the Criminal Division and its colleagues acted quickly to stop about half of the huge Binance hack.

The court ordered the government to seize or restrain more than $1.2 billion out of the $2.7 billion frozen. The distinction matters: freezing cryptocurrency means preventing the movement of money, while restraining means obtaining the right to seize the funds.

TraderTraitor Moves Stolen Binance Assets Through Crypto Networks

The FBI stated that military members of the Democratic People's Republic of Korea were behind the October 29 attack on Binance and used the alias "TraderTraitor." In a cyber alert issued on October 31, the FBI reported that the attackers were transferring the assets to accounts where the stolen funds were being converted into Ether (ETH).

The FBI said the attackers would use decentralized finance (DeFi) applications and instant swap services to convert the cryptocurrencies into other forms of funds. That would make transactions harder for investigators to trace, as the money moves through multiple blockchain networks and digital assets.

The FBI has appealed to cryptocurrency exchange operators, DeFi services, blockchain intelligence firms, and infrastructure providers to block any transactions connected to the wallet addresses it released for the laundering operation.

The investigation is still underway, as North Korean hackers keep trying to move the stolen funds using cryptocurrency bridges, mixers, and exchanges.

FaceStealer Uses Deepfakes to Steal More Than $400 Million

Alongside the Binance-related action, the Department of Justice announced the seizure of cloud-based infrastructure used in the FaceStealer campaign. According to the FBI, the investigation revealed that the perpetrators compromised people engaged in cryptocurrency, Web3, and open-source software development and stole more than $400 million in cryptocurrency over 18 months.

The video meetings were arranged using compromised accounts. The hackers presented pre-recorded footage of people known to the victims during the calls, and also used artificial intelligence-generated videos to impersonate influential figures in the cryptocurrency and Web3 space.

During the video calls, the attackers posed false technical issues — such as an inability to hear the victim — and then provided links or prompts for fixes, which led to the installation of malware on the victims' devices that gave access to cryptocurrency and other information.

The attackers would wait months or even years after initially infecting a computer before conducting thefts or hijacking communication accounts. They also used the compromised computers to access victims' contacts, social media accounts, and messages in order to identify more targets.

FBI agents seized more than 900 webcam recordings using a warrant issued by a federal court, disrupted the cloud computing resources used in the campaign, and published a technical report (joint cybersecurity advisory) explaining how the operation was carried out.

DOJ Action Highlights Risks to Crypto and Software Developers

FaceStealer targeted developers of open-source software. The campaign aimed to hack the accounts of people responsible for developing and maintaining software in order to carry out supply-chain attacks on other organizations' applications. In a supply-chain attack, compromising a trusted developer or dependency matters because every downstream application that relies on that code inherits the exposure.

The impact therefore extends beyond cryptocurrency holders. Hackers may be able to harm not only people working with cryptocurrencies but also software companies and their products, meaning businesses operating with open-source software could be at risk even if they do not deal in cryptocurrencies.

Patrick Grandy, Assistant Director of the FBI's Los Angeles Field Office, said the operation could deceive even technical experts by exploiting trusted contacts and reliable videoconferencing tools. People who did not believe they could be deceived by such attacks, he noted, may not have considered all the possible ways it could happen.

For cryptocurrency businesses, the developments reinforce the importance of checking meeting invitations, verifying identities through separate communication channels, and avoiding unfamiliar software installation prompts. Wallet monitoring and rapid response to law enforcement notifications have also become crucial for exchanges and infrastructure providers.

According to the Department of Justice, the tracing, freezing, seizure, and forfeiture of the Binance-related assets continue. Investigations into both the TraderTraitor and FaceStealer operations are ongoing, and the authorities have made requests for suspicious activity reports. What to watch from here is procedural: whether the restraints move toward final forfeiture, and whether additional seizures follow as investigators trace the remainder of the stolen funds.