WASHINGTON, United States – The US Department of Justice has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, marking a major step in efforts to recover assets taken during a cyberattack attributed by the Federal Bureau of Investigation to North Korean hackers.
The department announced the action on November 12, saying the amount covered by court authorization forms part of more than $2.7 billion in cryptocurrency frozen through cooperation between US authorities and private-sector partners. The government said efforts to trace, freeze, seize and forfeit the remaining stolen assets were continuing.
Court action covers part of frozen assets
The Justice Department said the court-authorized seizure or restraint applies to more than $1.2 billion of the cryptocurrency frozen after the October 29 attack.
The figure is included in the broader $2.7 billion freeze and should not be added to it as a separate recovery. Authorities have not said that the entire amount has been transferred into government custody or returned to affected parties.
The department said investigators and law enforcement partners were working with virtual asset service providers to prevent the stolen funds from moving beyond their reach.
FBI attributes attack to North Korean group
The FBI identified the operation behind the theft as TraderTraitor, a name it uses for malicious cyber activity attributed to North Korea.
In an October 31 advisory, the bureau said North Korean actors stole more than $6 billion in virtual assets from Binance on or around October 29. It reported that the attackers were converting stolen assets primarily into Ether and warned cryptocurrency service providers to block transactions involving identified addresses linked to the operation.
The Justice Department said the attackers continued moving assets through cryptocurrency bridges, mixers and exchanges as investigators pursued the funds. The FBI is coordinating recovery efforts with the US Secret Service and the Internal Revenue Service’s Criminal Investigation division.
■ Related News
Binance reports billions in affected assets
Binance reported that approximately $6.34 billion in digital assets were affected by the October 29 incident. In an update published November 3, the exchange said about $2.85 billion had been frozen or intercepted, subject to reconciliation and changes in market prices.
The company also said it had set aside more than enough funds to cover the losses and that 98% of the affected token assets had been replenished as of October 31. Binance said it would absorb the financial impact rather than pass the losses on to customers.
The exchange described the attack as involving unauthorized access to an internal wallet-signing service. Its preliminary findings detailed unauthorized transactions across several blockchain networks, including transfers of XRP, Solana, Optimism tokens and Bitcoin. Binance said its investigation remained ongoing and that independent security reviews were being arranged.
Recovery and forfeiture efforts continue
The Justice Department said the process of tracing and recovering the stolen cryptocurrency remained active. Its announcement did not provide a breakdown of the more than $1.2 billion covered by court authorization or specify when forfeiture proceedings would be completed.
The distinction is significant because freezing cryptocurrency can prevent its movement without necessarily establishing the government’s final ownership of the assets. Any eventual forfeiture and disposition must proceed through the applicable legal process.
For now, the court-authorized action represents a substantial step in the recovery effort, but the full amount stolen from Binance has not been recovered.
Primary Sources: U.S. Department of Justice, Office of Public Affairs, “Justice Department Announces Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency,” November 12, 2026, announcing court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance and reporting that combined government and private-sector efforts had frozen more than $2.7 billion; Federal Bureau of Investigation, “North Korea Responsible for $6 Billion+ Binance Attack,” October 31, 2026, attributing the October 29 theft to North Korean cyber actors identified as TraderTraitor and issuing guidance to virtual asset service providers; Binance, “29 October 2026 Binance Security Incident: Initial Findings and Response Update,” November 3, 2026, providing the exchange’s account of the incident, estimated losses, frozen or intercepted assets and customer-loss coverage.
