The US Department of Justice announced on November 12, 2026, that it obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency allegedly stolen from Binance by North Korean state-sponsored hackers, marking one of the largest single cryptocurrency enforcement actions in US history. The announcement covered two parallel efforts: the freezing of assets tied to the exchange breach and the disruption of a separate, allegedly related crypto theft campaign.

What the Court Orders Cover

According to the DOJ press release, federal prosecutors in the District of Columbia secured court-authorized seizure and restraint orders covering more than $1.2 billion in virtual assets tied to the Binance breach. Orders of this kind block the movement of targeted assets while legal proceedings determine their ultimate disposition. The action represents a coordinated effort spanning the Department of Justice, the FBI, the Secret Service, and the Criminal Investigation division of the Internal Revenue Service (IRS).

When the court-authorized measures are combined with freezes executed by US government agencies and private-sector partners, the total value of assets taken out of circulation exceeds $2.7 billion, according to the DOJ announcement. The orders secured in Washington cover roughly one-fifth of the $6 billion the department alleges was stolen in the breach.

In the announcement, Assistant Attorney General A. Tysen Duva described the operation as “immediately freezing billions of dollars’ worth of stolen Binance digital assets before they got beyond law enforcement reach.” The court authorization came roughly two weeks after the alleged October 29 breach, a timeline the department tied to keeping the stolen funds within law enforcement's reach.

Alleged Theft and North Korean Attribution

The DOJ alleges the underlying theft occurred on or about October 29, 2026, when TraderTraitor, a unit of the North Korean military, allegedly stole more than $6 billion in virtual assets from Binance — an incident the department characterized as the largest exchange hack on record. According to the DOJ, TraderTraitor operates under a network of aliases including Sapphire Sleet, BlueNoroff, APT38, UNC1069, Dangerous Password, CryptoCore, and Stardust Chollima.

According to unconfirmed reports cited by The Record, investigators believe the hackers gained initial access through an employee's device after months of preparation, though this intrusion method was not confirmed in the DOJ's official statement. A single source also reported that Kim Yo Jong, the sister of North Korean leader Kim Jong Un, issued a denial of North Korea's involvement on November 3, 2026, though the claim has not been independently verified. Neither detail is confirmed, leaving the initial-access method and North Korea's official position open questions as the case develops.

Blockchain analytics firm Elliptic tracked laundering activity across approximately 12,000 wallets on 11 blockchains, involving more than 40,000 transactions, according to data cited by The Record. Dispersion at that scale underscores why recovery efforts in major crypto thefts pair blockchain analytics with law enforcement action. In a technique also observed in the $1.4 billion Bybit hack, North Korea allegedly created at least six meme coins on the NEAR blockchain between November 5 and 7, cycling stolen funds through decentralized exchange liquidity pools in order to obscure the trail of the assets.

FBI Cyber Branch Operations Director Brett Leatherman stated in the DOJ announcement: “The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years.”

FaceStealer Operation and Systemic Developer Risk

Alongside the Binance asset recovery, the DOJ announced the disruption of a separate operation attributed to APT38, the same North Korean threat cluster named among TraderTraitor's aliases. The FaceStealer campaign allegedly stole more than $400 million in cryptocurrency over an 18-month period, using AI-generated deepfakes and fake video calls to deceive victims. That 18-month span marks the campaign as sustained rather than opportunistic.

As part of the FaceStealer investigation, the FBI separately seized more than 900 webcam videos of victims, with warrants executed in the Central District of California covering the seizure of cloud infrastructure.

Less widely reported is the supply chain dimension of the campaign. North Korean actors allegedly targeted maintainers of open-source JavaScript packages and Rust crates in order to embed malicious code in widely used developer libraries. That risk extends beyond individual victims to anyone who depends on the affected packages.

Market Impact and Enforcement Context

BNB, the native token of the Binance exchange, fell 7.46% in 24 hours to $588.37, giving the asset a market capitalization of approximately $77.38 billion, according to CoinGecko data as of November 9, 2026. The figures reflect a snapshot taken three days before the DOJ's announcement.

Implications for Developer and Web3 Infrastructure

For the creator economy and the infrastructure underpinning digital ownership, the broader implication of the announcement sits in the supply chain threat. NFT platforms, marketplaces, and token-gating protocols that rely on open-source JavaScript dependencies are directly exposed to the developer-targeting tactics attributed to FaceStealer. As North Korean actors evolve from exchange hacks to poisoning the tooling that developers use to build Web3 infrastructure, platform security reviews will need to extend well below the smart contract layer.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.