The U.S. Department of Justice has secured court authorization to seize or restrain more than $1.2 billion in cryptocurrency connected to the October hack of the Binance exchange, as federal investigators intensify efforts to recover assets allegedly stolen by North Korean hackers.

In an announcement on Thursday, the DOJ said authorities and private-sector partners have frozen more than $2.7 billion in stolen cryptocurrency. The department said the effort reflects coordination between government agencies and companies in the private sector. Investigators are continuing to trace additional funds moving through blockchain bridges, cryptocurrency mixers, and exchanges, where stolen assets may be transferred or concealed.

DOJ Pursues Assets Tied to Binance's $6 Billion Breach

Federal investigators attributed the October 29 attack on Binance to TraderTraitor, a hacking group associated with North Korea's military intelligence operations. The DOJ estimates that the group stole more than $6 billion during the breach.

Binance previously placed its losses at approximately $6.3 billion and said it allocated $6.34 billion in company funds to cover affected assets. The exchange also confirmed that it had completed coverage of impacted customer holdings and published an updated proof-of-reserves. Because Binance covered impacted customer holdings with company funds, the federal recovery effort centers on the stolen assets themselves rather than on customer reimbursement.

The court-approved action covering more than $1.2 billion forms part of a broader effort to restrict the movement of stolen cryptocurrency. The separate figure of more than $2.7 billion represents assets frozen through the wider recovery effort, rather than the amount covered by the latest court authorization. Measured against the estimated $6 billion in losses, both amounts represent a partial recovery, with the remainder subject to ongoing tracing across services and networks.

Principal Deputy Assistant Attorney General M. Scott Proctor accused North Korea of using cryptocurrency theft to finance its government and weapons programs. He said the DOJ's National Security Division would continue pursuing stolen assets and seeking their return. The division's involvement reflects the government's treatment of state-linked crypto theft as a national security matter rather than an ordinary financial crime.

Authorities have not provided a complete timeline for recovering the funds. Blockchain tracing operations remain underway as investigators follow additional transactions across different services and networks. With no recovery timeline announced, future court filings and seizure actions would offer the clearest public signal of the effort's progress.

FBI Seizes Infrastructure Behind North Korean FaceStealer Operation

The DOJ also announced action against a separate North Korea-linked cryptocurrency theft campaign known as FaceStealer. Federal authorities seized cloud infrastructure allegedly supporting the operation, which the FBI estimates caused more than $400 million in cryptocurrency losses over the past 18 months.

According to investigators, the attackers compromised communication accounts and used them to arrange fraudulent video meetings with potential victims. They impersonated people familiar to their targets through prerecorded footage and artificial intelligence-generated deepfakes. The tactic shows how AI-generated media has become practical tooling for financial crime, allowing attackers to borrow the likeness of trusted contacts on widely used video platforms.

During the calls, criminals introduced fabricated technical issues and persuaded victims to install malicious software. The software could then compromise cryptocurrency wallets and computer systems, giving attackers access to digital assets and other information.

Patrick Grandy, assistant director of the FBI's Los Angeles Field Office, warned that the scheme exploited trusted relationships and widely used video conferencing platforms.

Hackers Delayed Exploitation of Compromised Computers

Investigators found that in some cases attackers waited months, or even longer than a year, before exploiting computers they had previously compromised, leaving the intrusions dormant. The campaign also involved the use of stolen contact information to identify additional targets. Such dormancy complicates incident response, since an intrusion surfacing today may trace back to a compromise made long before any theft was noticed.

Among those targeted were open-source developers whose software could give attackers access to a wider group of users. The findings highlight how an initial compromise can be used to facilitate further attacks long after the original intrusion.

Federal agents seized more than 900 webcam recordings associated with FaceStealer victims and issued guidance to affected individuals.

The two cases illustrate the scope of the DOJ's campaign against cryptocurrency theft operations linked to North Korea. While authorities have secured restrictions on billions of dollars in suspected stolen assets, investigations into both the Binance breach and the FaceStealer campaign remain ongoing, leaving open how much more of the stolen funds can be recovered and what further actions follow from the FaceStealer takedown.