U.S. seizes $1.2 billion in crypto stolen from Binance in $6 billion North Korea-linked hack

U.S. authorities have seized or secured court orders to restrain more than $1.2 billion in cryptocurrency stolen from Binance in a massive $6 billion cyberattack linked to North Korean military hackers, marking a major breakthrough in efforts to recover funds from one of the largest cryptocurrency thefts in history.

The U.S. Department of Justice (DOJ) announced the action Thursday, November 12, revealing that government investigators and private cryptocurrency firms have frozen more than $2.7 billion of the stolen assets. The operation comes just two weeks after hackers drained more than $6 billion from Binance on October 29, raising fresh concerns about the cryptocurrency industry’s security.

Federal investigators attributed the attack to TraderTraitor, a North Korean hacking operation associated with the country’s military. The group has been accused of targeting cryptocurrency exchanges and digital asset companies to generate money for Pyongyang.

“Today the Department of Justice announced coordinated actions against the Democratic People’s Republic of North Korea (DPRK) government’s schemes to fund its regime through the massive theft of cryptocurrency,” DOJ said in a news release.

The DOJ added: “These actions include the seizure of cloud-based infrastructure used in the FaceStealer social engineering scheme that has resulted in the theft of more than $400 million worth of cryptocurrency and the court-authorized seizure and restraint of more than $1.2 billion worth of cryptocurrency recently stolen from Binance, a virtual currency exchange.”

The scale of the theft is staggering. At roughly $6.3 billion, the Binance breach dwarfs previous cryptocurrency hacks and highlights the growing financial threat posed by state-backed cybercriminals.

U.S. Freezes $2.7 Billion as North Korean Hackers Race to Launder Stolen Crypto

The Justice Department said the $1.2 billion seizure and restraint orders represent part of a broader operation involving the FBI, U.S. Secret Service, Internal Revenue Service, and private cryptocurrency service providers.

Investigators have been tracing the stolen digital assets across blockchain networks, working with exchanges and other companies to prevent the hackers from converting or moving the funds beyond their reach.

The operation remains active. According to the DOJ, TraderTraitor hackers continue to move stolen cryptocurrency through digital asset exchanges, blockchain bridges, and mixing services that make transactions harder to trace.

Federal authorities have warned cryptocurrency service providers to block transactions associated with wallets linked to the stolen Binance funds.

Meanwhile, the government has obtained court authorization to seize or restrain more than $1.2 billion, but that does not mean all the cryptocurrency has been returned to Binance or its customers. Further legal proceedings may be necessary to determine ownership and recover the assets.

U.S. officials say North Korea has turned cryptocurrency theft into a significant source of funding for its government and weapons programs.

“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said Principal Deputy Assistant Attorney General for National Security M. Scott Proctor. “Today’s announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime. The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.”

The operation signals how much cryptocurrency enforcement has changed. Blockchain transactions can move across national borders in seconds, yet coordinated intervention by governments and exchanges can still prevent stolen assets from being cashed out.

FBI Exposes FaceStealer, a $400 Million North Korean Deepfake Crypto Scam

The Binance seizure was just one part of Thursday’s announcement.

The Justice Department revealed that authorities disrupted FaceStealer, a separate North Korean cybercrime campaign that stole more than $400 million in cryptocurrency over the past 18 months, CNBC reported.

Unlike the Binance breach, FaceStealer relies heavily on manipulating people rather than directly attacking cryptocurrency exchange infrastructure.

The scheme begins with something familiar: a video call.

Hackers compromise communication accounts and use secretly recorded videos or AI-generated deepfakes to impersonate people their targets know and trust. During the meeting, the attackers introduce a supposed technical problem and convince victims to install software presented as a fix.

That software secretly installs malware, giving the attackers access to sensitive information, cryptocurrency holdings, and communication accounts.

The consequences can surface long after the initial encounter. Investigators found cases in which hackers waited months or more than a year before stealing assets or using compromised accounts to target additional victims.

The FBI said the campaign has increasingly targeted cryptocurrency professionals, Web3 employees, and developers maintaining open-source software. Investigators seized cloud infrastructure supporting the operation and more than 900 webcam videos of victims.

Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office, warned that the scheme could fool experienced technology professionals.

“It exploits our trust in ubiquitous video conference platforms and valued personal relationships. If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” Grandy said.

For cryptocurrency companies and startups, the two operations expose different sides of the same security problem. Billions can disappear through attacks on digital asset infrastructure, and sophisticated impersonation scams can turn a routine video meeting into an entry point for theft.

The $1.2 billion seizure represents significant progress for U.S. investigators, but billions remain outside the announced freeze. The larger challenge is stopping the next attack before the money moves.