The US Department of Justice announced on November 12, 2026, that it obtained court authorization to seize or restrain over $1.2 billion in cryptocurrency stolen from Binance, according to an official Justice Department press release.
The court order covers a portion of more than $2.7 billion in virtual assets frozen through joint efforts between US law enforcement and private-sector partners following the October 29, 2026 exploit totaling roughly $6.3 billion.
Federal investigators attributed the exchange breach to North Korean military cyber actors tracked as TraderTraitor in an FBI cyber threat alert issued on October 31, 2026, urging virtual asset service providers to block flagged addresses.
Subsequent technical assessments established that hackers maintained prolonged access inside internal systems for roughly eight weeks prior to initiating unauthorized transfers across ten blockchains.
Following the initial drain, the perpetrators executed cross-chain laundering maneuvers to evade centralized issuer freezes, including routing stolen Solana through THORChain alongside conversions into Ether.
Binance has completed coverage of assets impacted in the security incident and we have published a new Proof of Reserves snapshot. Once the zero-knowledge proof is generated, users can independently verify that their assets are backed at a minimum of 1:1 -…
— Binance (@binance) November 12, 2026
Exchange leadership stated that affected customer balances were replenished using corporate reserves and released an updated proof-of-reserves snapshot showing at least one-to-one asset backing in an official Binance X statement on November 12, 2026.
Takedown of FaceStealer Social Engineering Infrastructure
In a concurrent enforcement action led by the Central District of California, US authorities seized cloud infrastructure supporting FaceStealer, a North Korean social engineering operation that stole over $400 million in digital assets across the preceding 18 months.
Threat actors lured victims into video conferences using hijacked accounts and played surreptitiously recorded webcam footage or AI-generated deepfakes of prominent Web3 figures before delivering malware disguised as audio or video troubleshooting fixes.
Under a federal search warrant, the FBI seized more than 900 webcam videos of targeted individuals working across cryptocurrency firms and open-source software repositories.
The Justice Department linked the campaign to threat clusters tracked publicly as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima, noting growing efforts to compromise open-source software supply chains.
Investigators from the Criminal Division, National Security Division, US Secret Service, and IRS Criminal Investigation continue tracing the remaining stolen Binance funds across bridges, mixers, and exchanges for future forfeiture.
This article is for informational purposes only and does not constitute financial advice.
