Federal authorities and private companies have frozen more than $2.7 billion following the $6.3 billion cryptocurrency theft, as investigators pursue assets moved through exchanges, bridges and mixers. The U.S. Department of Justice has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance during an October cyberattack attributed to North Korean hackers. Announcing the development on November 12, 2026, the department said coordinated efforts involving federal investigators, cryptocurrency companies and other private-sector partners had frozen more than $2.7 billion of the stolen assets.
The October 29 breach involved more than $6 billion in cryptocurrency, making it the largest reported digital asset theft to date. The Federal Bureau of Investigation attributed the attack to TraderTraitor, a North Korean military-linked hacking group previously associated with cryptocurrency theft and sophisticated cyber intrusions. The $1.2 billion covered by court authorization forms part of the $2.7 billion already frozen, rather than representing an additional recovery. Authorities are continuing to pursue the remaining stolen assets as the attackers attempt to move cryptocurrency through decentralized infrastructure and other financial services.
Federal Authorities Freeze Nearly Half of Stolen Binance Assets
The Justice Department said its National Security Division, Criminal Division and federal prosecutors coordinated with virtual asset service providers to restrict access to stolen cryptocurrency immediately after the attack. The Federal Bureau of Investigation, U.S. Secret Service and Internal Revenue Service Criminal Investigation division have participated in tracing transactions and identifying addresses associated with the attackers. The approximately $2.7 billion frozen represents more than 40% of the estimated $6.3 billion stolen. According to Bloomberg, stablecoin issuers Tether and Circle participated in efforts to prevent the movement of compromised assets.
The department subsequently secured judicial authorization covering more than $1.2 billion of the restricted cryptocurrency. However, freezing assets, obtaining seizure authorization and completing forfeiture proceedings are legally distinct stages. A freeze prevents assets from being transferred, while seizure or restraint places them under legal control. Permanent forfeiture and restitution may require additional judicial proceedings. The DOJ has not disclosed a final timetable for returning recovered assets to eligible claimants. Investigators also warned that TraderTraitor continues attempting to launder stolen funds using cryptocurrency bridges, mixing services and exchanges.
Binance Covers Customer Losses as North Korean Investigation Continues
Binance separately announced that it had completed coverage of assets affected by the October breach, which it estimated at approximately $6.3 billion. The exchange said it had allocated company funds to address the incident and published an updated proof-of-reserves snapshot. The recovery effort comes amid broader U.S. enforcement action against North Korean cryptocurrency theft operations. On November 12, the Justice Department also announced the disruption of FaceStealer, a separate cybercrime campaign involving fraudulent video meetings, impersonation and malicious software downloads. Authorities attributed more than $400 million in cryptocurrency theft over 18 months to that operation.
However, investigators have not established that FaceStealer was responsible for the Binance breach. U.S. officials have repeatedly linked North Korean cybercrime proceeds to financing government activities and prohibited weapons programs. The Binance investigation demonstrates the importance of cooperation between law enforcement, exchanges and stablecoin issuers in restricting stolen digital assets. Nevertheless, billions remain outside the announced freezes, and further recovery will depend on investigators’ ability to trace funds across blockchain networks and obtain control over additional assets.
