The U.S. Department of Justice obtained court authorization on November 12, 2026, to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance during an October cyberattack attributed to North Korean hackers. The October 29 breach involved more than $6 billion in cryptocurrency, making it the largest reported digital asset theft to date, with the Federal Bureau of Investigation attributing the attack to TraderTraitor, a North Korean military-linked hacking group. Federal authorities and private companies have frozen more than $2.7 billion following the theft, with the $1.2 billion court authorization forming part of the frozen assets rather than representing an additional recovery.
Federal Authorities Freeze $2.7 Billion in Stolen Binance Assets
The Justice Department said its National Security Division, Criminal Division and federal prosecutors coordinated with virtual asset service providers to restrict access to stolen cryptocurrency immediately after the attack. The Federal Bureau of Investigation, U.S. Secret Service and Internal Revenue Service Criminal Investigation division have participated in tracing transactions and identifying addresses associated with the attackers. The approximately $2.7 billion frozen represents more than 40% of the estimated $6.3 billion stolen. According to Bloomberg, stablecoin issuers Tether and Circle participated in efforts to prevent the movement of compromised assets.
The department subsequently secured judicial authorization covering more than $1.2 billion of the restricted cryptocurrency. Freezing assets, obtaining seizure authorization and completing forfeiture proceedings are legally distinct stages, with a freeze preventing transfers while seizure or restraint places assets under legal control. Permanent forfeiture and restitution may require additional judicial proceedings.
Binance Covers Customer Losses as DOJ Disrupts Separate North Korean Campaign
Binance announced that it had completed coverage of assets affected by the October breach, which it estimated at approximately $6.3 billion. The exchange said it had allocated company funds to address the incident and published an updated proof-of-reserves snapshot.
On November 12, the Justice Department also announced the disruption of FaceStealer, a separate cybercrime campaign involving fraudulent video meetings, impersonation and malicious software downloads. Authorities attributed more than $400 million in cryptocurrency theft over 18 months to that operation. Investigators have not established that FaceStealer was responsible for the Binance breach.
U.S. officials have repeatedly linked North Korean cybercrime proceeds to financing government activities and prohibited weapons programs.
FAQ
What did the DOJ authorize on November 12, 2026?
The U.S. Department of Justice obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance during an October cyberattack attributed to North Korean hackers. This authorization forms part of the $2.7 billion already frozen by federal authorities and private companies.
Who was responsible for the Binance breach?
The Federal Bureau of Investigation attributed the October 29 attack to TraderTraitor, a North Korean military-linked hacking group previously associated with cryptocurrency theft and sophisticated cyber intrusions. The breach involved more than $6 billion in cryptocurrency, making it the largest reported digital asset theft to date.
