The U.S. Department of Justice seized more than $1.2 billion in stolen cryptocurrency from Binance. It was the largest crypto heist in history.
The seizure, authorized by a court, marks a major victory in the government’s effort to recover funds from the October 29 hack of the world’s largest crypto exchange. The theft, valued at over $6.3 billion, was attributed by the FBI to a North Korean hacking group known as TraderTraitor.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y
The Justice Department announced the coordinated action on Thursday. It revealed the seizure resulted from a partnership between the U.S. government and private virtual asset service providers. These efforts have frozen more than $2.7 billion of the stolen funds to date.
“North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, the department's principal deputy assistant attorney general for national security.
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination… pic.twitter.com/FQQ3vKT6GU
This action effectively freezes nearly half of the total stolen assets. It prevents them from being moved further.
The process typically involves the U.S. government filing a claim of forfeiture in court. A judge then determines who has a rightful claim to the recovered funds, according to reports from CBS News and others.
https://t.co/sU9dUqLQDH
$1.2 Billion Seized, $2.7 Billion Frozen
The Justice Department has vowed to continue using all available tools to seize and return the “ill-gotten gains” from North Korean cybercrime schemes. The fight against these state-sponsored actors is far from over.
FBI Blames TraderTraitor for Binance Hack via Social Engineering
The massive theft from Binance took place on the evening of October 29, 2026. The FBI has directly blamed the incident on TraderTraitor. The hacking group is linked to the North Korean military. North Korea has denied any involvement in the attack.
🚨 BIG: The US Department of Justice seized infrastructure linked to North Korea’s $400 million FaceStealer crypto theft scheme and froze more than $1.2 billion in cryptocurrency stolen from Binance. pic.twitter.com/i11sCTcP6Z
The hackers used a sophisticated social engineering scheme that began months before the theft. It involved a compromised employee machine. They used an internal AI tool to seize control of other systems. This allowed them to drain wallets containing 64 different tokens and other cryptocurrencies.
Binance found no evidence private keys were leaked. The keys are used to authorise spending or withdrawal from crypto-wallets.
Cryptocurrency Theft Funds North Korean Weapons Program
“The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years,” said FBI cyber director Brett Leatherman.
North Korea Likely Holds Billions in Stolen Binance Funds
While authorities have recovered much of the stolen Binance funds, a substantial amount has not been found. Blockchain analytics firm Elliptic reported that approximately $3.11 billion, mostly in Ethereum and Bitcoin, is still in addresses linked to the theft. It is “very likely” still held by North Korea.
Binance has completed coverage of assets impacted in the security incident and we have published a new Proof of Reserves snapshot. Once the zero-knowledge proof is generated, users can independently verify that their assets are backed at a minimum of 1:1 -…
Elliptic reported that the laundering has used more than 20,000 wallets on 16 blockchains and at least 36 services.
Some funds have been mixed.
🚨NEW: The DOJ says it has seized and frozen more than $1.2 billion in crypto stolen from @binance by North Korean hackers last month. It also seized infrastructure used in “FaceStealer,” a social engineering scheme tied to more than $400 million in crypto theft. pic.twitter.com/fS7TWhRDV8
The laundering process involves thousands of wallets and transactions. Funds are swapped across different blockchains. Authorities expect the remaining assets to be converted to Bitcoin and cashed out through over-the-counter brokers over the coming months. This is similar to tactics used after a 2025 hack.
Earlier coverage: DOJ Targets Cryptocurrency Tied to North Korean Binance Hack
