DOJ Can Seize or Restrain Over $1.2 Billion in Stolen Binance Assets - Securities.io
The U.S. Department of Justice announced on November 12, 2026, that it obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance.
Combined U.S. government and private-sector efforts have frozen more than $2.7 billion following the theft of over $6 billion in virtual assets from Binance on or about October 29, 2026. The announcement concerns court authorization to seize or restrain part of the frozen amount, not a completed forfeiture.
The department said efforts to trace, freeze, seize and forfeit the assets remain ongoing as TraderTraitor actors continue to launder them through cryptocurrency bridges, mixers and exchanges. TraderTraitor is the FBI's name for the specific North Korean malicious cyber activity behind the theft.
As the Department's liaison to the digital asset industry, the Criminal Division quickly and efficiently used its expertise to immediately halt about half of this historic breach.
Recovery Coordination
The National Security Division's National Security Cyber Section, the Criminal Division's Computer Crime and Intellectual Property Section, and the U.S. Attorney's Office for the District of Columbia worked with virtual asset service providers to interdict the stolen assets.
The FBI's Los Angeles Field Office, Cyber Division and Virtual Asset Unit are coordinating the bureau's recovery work with the U.S. Secret Service and IRS Criminal Investigation. The FBI's October 31, 2026, alert attributed the theft to North Korea.
The FBI reported observed conversions of stolen assets primarily into Ether and anticipated further laundering through DeFi and instant-swap services. Authorities urged virtual asset service providers to block transactions involving or derived from the listed addresses.
FaceStealer Campaign Disruption
A separate action by the U.S. Attorney's Office for the Central District of California disrupted cloud-based infrastructure used in FaceStealer, a North Korean social-engineering campaign that stole over $400 million in cryptocurrency during the 18 months preceding the announcement.
Acting under a federal warrant, the FBI seized more than 900 webcam videos of victims. The FaceStealer campaign used imposter video-conferencing platforms, secretly recorded webcam video and hijacked communication accounts to lure targets into realistic fake meetings.
Prerecorded or deepfake videos simulated trusted contacts before a fake technical error prompted targets to follow a link or prompt that installed malware. The campaign targeted cryptocurrency and Web3 personnel, increasingly focusing on open-source software developers and maintainers.
The FBI said the actors sought access to their devices and software repository accounts with the objective of compromising the software supply chain, potentially affecting millions of downstream users.
Ongoing Recovery Challenges
The two operations address different stages of North Korea's cryptocurrency theft activity: preserving assets stolen from Binance and disrupting infrastructure used to compromise new victims.
In the Binance case, the scale of final recovery remains tied to continued tracing, seizure and forfeiture work as the actors keep moving assets through bridges, mixers and exchanges.
Related
