- Federal authorities obtained court authorization to seize or restrain more than $1.2 billion stolen in a $6 billion-plus cryptocurrency attack on Binance attributed to North Korean hackers.
- U.S. agencies and private-sector partners have frozen more than $2.7 billion in stolen assets, disrupting efforts to launder cryptocurrency through digital exchanges and financial platforms.
- Investigators also disrupted North Korea’s FaceStealer operation, which allegedly stole more than $400 million through sophisticated cyberattacks involving artificial intelligence, deepfake videos and compromised communications.
Federal authorities announced Thursday that they secured court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance in an October cyberattack attributed to North Korea. The theft, estimated at approximately $6.3 billion, ranks as the largest cryptocurrency heist in history. The FBI identified the perpetrators as TraderTraitor, a hacking operation linked to North Korea’s military. Coordinated efforts involving federal investigators, financial authorities and private cryptocurrency companies have frozen more than $2.7 billion in stolen digital assets.
The Justice Department said investigators continue tracking stolen cryptocurrency through exchanges, financial intermediaries and laundering networks. Federal officials also announced the disruption of FaceStealer, a separate North Korean operation responsible for allegedly stealing more than $400 million over 18 months. The scheme employed manipulated videos, compromised messaging accounts and malicious software to deceive victims. Authorities contend that North Korea systematically exploits cryptocurrency markets to generate revenue supporting its government and prohibited weapons programs.
Why It Matters
The recovery effort demonstrates that coordinated American law enforcement and private-sector cooperation can disrupt sophisticated foreign cybercriminal operations before stolen digital assets disappear into international financial networks. However, the extraordinary scale of the Binance theft exposes vulnerabilities in cryptocurrency infrastructure that hostile governments can exploit. North Korea’s alleged use of stolen funds to finance prohibited weapons programs transforms financial cybercrime into a direct national security concern.
The additional discovery of artificial intelligence-driven deception underscores an expanding threat to businesses, investors and technology developers. Criminal operations increasingly exploit trusted communications and digital identities rather than relying exclusively on technical vulnerabilities. Protecting American financial interests requires aggressive investigation, effective international enforcement and stronger private-sector safeguards. The successful freezing of billions demonstrates the value of targeted federal action, but substantial unrecovered assets illustrate why continued vigilance, institutional accountability and stronger cybersecurity protections remain essential to protecting legitimate commerce and denying adversarial regimes access to illicit financing.
Sources
- Primary source: https://justthenews.com/nation/crime/fbi-says-12-billion-stolen-binance-north-korea-has-been-recovered
- U.S. Department of Justice — Coordinated actions against North Korean cryptocurrency theft: https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency
- FBI — North Korea responsible for $6 billion-plus Binance attack: https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack/layout_view
- Independent reporting on cryptocurrency recovery and FaceStealer disruption: https://www.theblock.co/news/business/2026-11-12-doj-seize-1-2-billion-binance-hack-north-korea-facestealer-439065
- Additional reporting on federal asset seizures and North Korean cybercrime: https://www.cbsnews.com/news/fbi-cryptocurrency-1-2-billion-binance/