The U.S. Department of Justice said on November 12, 2026, that more than $2.7 billion of the more than $6 billion stolen from Binance on October 29, 2026, has been frozen. The department has court authorization to seize or restrain more than $1.2 billion of that amount.
Federal investigators worked with virtual asset service providers to interdict the stolen assets, the DOJ said. Assistant Attorney General A. Tysen Duva said the Criminal Division's response immediately halted about half of the breach (DOJ). Bloomberg reports that Tether and Circle froze the $2.7 billion in the immediate aftermath of the October 29 break-in (Bloomberg).
Efforts to trace, freeze, seize and forfeit the stolen assets are ongoing, and the hackers continue to launder them through cryptocurrency bridges, mixers and exchanges. The FBI attributes the theft to North Korean military members it calls "TraderTraitor," and in the week before the announcement it issued a Cyber Alert urging virtual asset service providers to block transactions with addresses those actors are using (DOJ). Investigators are continuing to pursue the funds that remain unfrozen (Bloomberg).
The same announcement covered a separate North Korean operation known as "FaceStealer." The DOJ seized cloud-based infrastructure used in the scheme, which has stolen more than $400 million in cryptocurrency over the last 18 months. Hackers lure targets into video meetings, play recorded or deepfake videos of people the targets know, and then prompt a fake technical fix that installs malware. Under a federal warrant, the FBI seized over 900 webcam videos of victims (DOJ).
FBI Cyber Branch Operations Director Brett Leatherman said North Korea relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, and that it has stolen billions of dollars in recent years. Principal Deputy Assistant Attorney General M. Scott Proctor of the National Security Division said the division will use every tool at its disposal to seize and return the stolen funds. The FBI also published a report on how FaceStealer works, with steps to protect against it and for victims to take after a compromise, and created a resource website at fbi.gov/facestealer (DOJ).
