US seizes more than $1.2 billion in cryptocurrency stolen from Binance, blamed on North Korean hackers

The US Justice Department said on Thursday, 12 November 2026, that it had obtained court authorisation to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, the world's largest cryptocurrency exchange, according to a department press release.

The department said more than $6 billion in virtual assets was stolen from Binance on or about 29 October 2026. CBS News, carrying an Associated Press report, put the theft at about $6.3 billion and described it as the biggest cryptocurrency heist in history. The FBI attributes the theft to members of North Korea's military whom it calls TraderTraitor, the department said.

Freezes and seizures

According to the Justice Department, efforts by the government and private companies have frozen more than $2.7 billion of the stolen assets, and the $1.2 billion covered by court authorisation is part of that amount. Investigators worked with virtual asset service providers to freeze and interdict the funds, the department said. The release did not name the court that authorised the seizures.

Assistant Attorney General A. Tysen Duva of the Criminal Division said the department helped "immediately halt about half of this historic breach", according to the release.

CBS News reported that the government typically files a forfeiture claim in such cases, after which a judge decides who has a legitimate claim to the funds. The Justice Department said efforts to trace, freeze, seize and forfeit the remaining stolen assets are continuing, led by the FBI's Los Angeles Field Office, Cyber Division and Virtual Asset Unit with the Secret Service and IRS Criminal Investigation.

The department said the hackers continue to try to launder the stolen assets through cryptocurrency bridges, mixers and exchanges. Last week the FBI, the Secret Service and IRS Criminal Investigation issued an alert attributing the theft to North Korea and urging providers to block transactions linked to laundering addresses, according to the release.

Separate 'FaceStealer' scheme

The department also announced action against a separate scheme it called FaceStealer, which it said North Korea used to steal more than $400 million in cryptocurrency over the past 18 months. The US Attorney's Office for the Central District of California disrupted cloud-based infrastructure used in the scheme, and the FBI seized more than 900 webcam videos of victims under a federal warrant, the department said.

According to the release, the hackers send video meeting invitations from accounts stolen from earlier victims, record targets through their webcams, play prerecorded videos of people the targets know or AI-generated deepfakes of well-known figures in the cryptocurrency industry, and then prompt targets to "fix" a fake technical error, which installs malware. CyberScoop reported that the hackers hijacked accounts on Telegram, LinkedIn, Slack and Discord and used look-alike domains hosting fake Zoom and Microsoft Teams pages.

What officials said

"North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," said M. Scott Proctor, principal deputy assistant attorney general for national security, in the release.

Bill Essayli, first assistant US attorney for the Central District of California, said: "Cryptocurrency unfortunately has become fertile ground for North Korea to defraud victims and fund its malign activities," according to CBS News.

No response from Binance or from the North Korean government was included in the reports reviewed for this story.