US Seizes $1.2 Billion in Stolen Binance Crypto
The United States has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, the world’s largest cryptocurrency exchange, in what investigators describe as the biggest cryptocurrency theft in history. The Federal Bureau of Investigation announced the development on November 12, 2026, following weeks of efforts to track and freeze the stolen digital assets. The recovery effort represents a significant step toward preventing the hackers from moving or laundering the money, although the full amount stolen has not yet been recovered.
The original cyberattack resulted in approximately $6.3 billion worth of cryptocurrency being taken from Binance in October. Investigators attributed the attack to a North Korean hacking group known as TraderTraitor, which has previously been linked to major cryptocurrency thefts. The scale of the incident shocked the digital asset industry because billions of dollars were reportedly moved within a remarkably short period, making it one of the most significant financial cyberattacks ever recorded.
According to the FBI, the US government and private-sector partners have collectively frozen more than $2.7 billion in assets connected to the theft. The Justice Department has now obtained court authorization covering more than $1.2 billion of that total. This distinction is important because freezing or restraining cryptocurrency does not automatically transfer permanent ownership to the government. Authorities generally must pursue forfeiture proceedings, during which a judge determines whether the assets can legally be taken and who may have a legitimate claim to them.
The investigation has focused on identifying the digital wallets and transactions used by the hackers after the attack. Cryptocurrency transactions are recorded on blockchain networks, creating a digital trail that investigators and blockchain analytics companies can examine. Although the technology can make it difficult to identify the individuals behind a transaction, tracking the movement of assets across different wallets and platforms can help authorities identify suspicious activity and coordinate with exchanges and other service providers to prevent further transfers.
Investigators have identified TraderTraitor as the group responsible for the Binance theft. The group is associated with North Korea’s broader cyber operations, which US authorities have repeatedly accused of targeting financial institutions and cryptocurrency platforms. The FBI has previously linked the same hacking operation to the theft of approximately $1.5 billion from the cryptocurrency exchange Bybit in 2025. The repeated attacks have raised concerns about the growing sophistication of state-linked cybercriminal networks and their ability to exploit weaknesses in digital financial systems.
The stolen funds have reportedly been converted primarily into Ethereum, one of the world’s most widely used cryptocurrencies. Investigators believe the hackers may attempt to move the assets through decentralized finance platforms, instant cryptocurrency swap services, and other channels designed to make transactions more difficult to trace. These methods can involve breaking large amounts into smaller transfers and moving them across multiple blockchain networks. Law enforcement agencies are working with industry partners to identify these movements and prevent the stolen funds from entering the broader financial system.
The FBI also announced a separate investigation involving a North Korean social engineering operation known as FaceStealer. Officials said the scheme resulted in approximately $400 million worth of cryptocurrency being stolen over the previous 18 months. Unlike the Binance attack, which involved a major cryptocurrency exchange, the FaceStealer operation reportedly relied on a combination of messaging application hijacking and manipulated video communications, including deepfake recordings. The alleged methods demonstrate how cybercriminals are increasingly combining traditional deception techniques with artificial intelligence-generated content.
According to US officials, FaceStealer involved a complicated process in which attackers hijacked popular messaging applications and used recorded deepfake videos as part of their social engineering activities. Such tactics can make fraudulent communications appear more convincing, potentially allowing criminals to impersonate trusted individuals or organizations. The FBI’s warning highlights how the growing availability of artificial intelligence tools can create additional challenges for cybersecurity professionals, financial institutions, and ordinary users who rely on digital communications to conduct transactions.
US authorities have repeatedly accused North Korea of using cryptocurrency theft and other cybercrime operations to generate money for its government and support prohibited weapons programs. International sanctions have restricted the country’s access to many traditional financial channels, increasing concerns that cyber operations have become an alternative source of revenue. Cryptocurrency theft offers criminal networks the opportunity to move large amounts of money across borders, although investigators continue developing methods to trace transactions, identify participants, and recover stolen assets.
The developments also come amid broader international concerns about North Korea’s cyber capabilities. Governments and cybersecurity experts have linked North Korean hacking groups to attacks against financial institutions, businesses, and technology organizations in several countries. The repeated targeting of cryptocurrency platforms has made digital asset security an important national security issue. US officials have emphasized cooperation between law enforcement agencies, blockchain analytics firms, cryptocurrency exchanges, and international partners as essential to disrupting these operations and limiting the financial benefits hackers can obtain.
The latest court authorization represents progress in the effort to recover the Binance funds, but it does not mean that the entire $6.3 billion has been returned to its rightful owners. More than $2.7 billion has been frozen through combined government and private-sector efforts, while the remaining assets may still be subject to tracing and recovery attempts. Future forfeiture proceedings will determine the legal ownership of assets seized by the government. The case highlights the challenges of policing cryptocurrency theft across international borders and raises important questions about how digital financial platforms can strengthen security against increasingly sophisticated cyberattacks.
Key Legal Outcomes
- The FBI announced that the US government had obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency connected to the Binance theft.
- Government agencies and private-sector partners have collectively frozen more than $2.7 billion of the approximately $6.3 billion stolen.
- The FBI attributed the Binance attack to TraderTraitor, a North Korean hacking group previously linked to other major cryptocurrency thefts.
- The Justice Department is expected to pursue forfeiture proceedings, allowing a judge to determine whether the recovered assets can legally be taken and who has a legitimate claim to them.
- The FBI separately accused North Korea of operating the FaceStealer scheme, which allegedly stole approximately $400 million in cryptocurrency over 18 months.
Why It Matters
- Financial security: The Binance incident demonstrates how vulnerable digital asset platforms can be to sophisticated cyberattacks involving billions of dollars.
- National security: The alleged involvement of North Korean hackers raises concerns about cryptocurrency theft being used to generate funds for prohibited government activities.
- Cybercrime prevention: The recovery effort highlights the importance of cooperation between law enforcement, cryptocurrency exchanges, and blockchain analytics companies.
- AI-related threats: The FaceStealer operation demonstrates how deepfake technology and messaging application hijacking can make social engineering attacks more convincing.
- Asset recovery: The court-authorized seizure process shows that governments can pursue cryptocurrency connected to criminal activity, although recovering and legally forfeiting the funds can be complicated.
