US blocks $1.2 billion in crypto stolen from Binance
AI image In short
- The US Department of Justice says more than $1.2 billion in crypto from the Binance hack has been seized or frozen.
- The FBI attributes the Binance theft to North Korea's TraderTraitor hacking group.
- Authorities have also targeted infrastructure linked to the separate FaceStealer campaign.
- The Justice Department says FaceStealer was responsible for more than $400 million in crypto theft.
More than $1.2 billion in cryptocurrency. That is the amount the US Department of Justice says it has secured following last month's massive Binance hack. American authorities are targeting North Korean hackers held responsible for the billion dollar theft. But the operation does not stop there. A separate North Korean cyber network has also been targeted after allegedly stealing more than $400 million in crypto through sophisticated deception and digital techniques.
US authorities move to secure $1.2 billion
The US Department of Justice has announced that more than $1.2 billion in cryptocurrency stolen during the Binance hack has been frozen and secured.
According to the announcement, the assets were stolen from Binance last month by hackers linked to North Korea. US authorities obtained court authorization to seize the digital assets or prevent them from being transferred further.
It is a significant development in the investigation of one of the largest cryptocurrency thefts ever recorded.
The action also demonstrates that the US government is not only trying to identify those responsible, but is actively working to prevent the stolen assets from disappearing beyond the reach of investigators.
There is, however, an important distinction: freezing or legally securing cryptocurrency does not automatically mean that the full amount has already been returned to Binance or its rightful owners.
North Korea blamed for the Binance hack
On October 31, 2026, the FBI officially attributed the theft of more than $6 billion in digital assets from Binance to North Korea.
The agency named the operation TraderTraitor.
The hacking group has previously been linked to major attacks against cryptocurrency businesses and international digital infrastructure. According to the FBI, the stolen assets were largely converted into Ethereum after the attack.
The attackers then attempted to conceal the origin of the cryptocurrency by using different blockchains, exchange services and DeFi platforms.
US authorities believe that the proceeds from these attacks generate revenue for the North Korean regime. This is therefore not simply cybercrime for personal profit. According to the US government, these activities may also help finance the regime and other illicit operations.
How did hackers steal billions from Binance?
The attack was not a simple attempt to guess a password. Binance described a campaign that had taken months to prepare.
According to the exchange, employees were approached through fake recruitment interviews. The attackers posed as potential employers and used convincing communication to build trust.
One employee was eventually sent an assignment containing malicious software. This allowed the attackers to gain access to internal systems.
They then abused access permissions and technical tools to carry out unauthorized transactions.
The incident demonstrates that even major international cryptocurrency exchanges can be vulnerable when attackers manage to compromise employees or internal systems.
A second North Korean network: FaceStealer
On the same day, the US Department of Justice also announced a separate operation targeting another North Korean cyber campaign: FaceStealer.
This operation is separate from the TraderTraitor group linked to the Binance hack.
According to the Justice Department, the FaceStealer campaign resulted in more than $400 million in stolen cryptocurrency.
The method was particularly sophisticated. Hackers approached victims through people they believed they knew or trusted. They were then invited to video calls using fake versions of popular meeting platforms.
During the call, victims were shown a supposed technical error. To resolve the issue, they were instructed to open a link or run a file.
This secretly installed malicious software on their computers.
The attackers could then gain access to accounts, contacts and other digital systems. Images of victims were also secretly recorded and could later be used to target additional people.
Artificial intelligence makes digital deception more convincing
One particularly concerning aspect of the FaceStealer campaign is the use of artificial intelligence.
According to the FBI, North Korean hackers are using AI techniques to create convincing deepfake videos of well known figures in the cryptocurrency and blockchain industries.
This makes it increasingly difficult to distinguish a genuine video call from a manipulated one.
A familiar name, a convincing face on screen and an apparently normal technical issue may be enough to persuade someone to install malicious software.
The US Department of Justice has therefore targeted not only financial assets but also the cloud infrastructure used in the FaceStealer campaign.
By seizing this infrastructure, authorities are attempting to disable the hackers' technical capabilities and prevent further victims.
What does this mean for Binance and crypto investors?
For Binance, securing more than $1.2 billion is an important development. It demonstrates that cooperation between international law enforcement agencies, blockchain investigators and cryptocurrency companies can produce results.
However, it does not mean that all the stolen assets have been recovered.
In an attack of this scale, stolen assets are often distributed across hundreds or thousands of wallets and multiple blockchains. Some cryptocurrencies can be frozen by their issuers, while other digital assets cannot be blocked in the same way.
This makes recovering the full amount particularly difficult.
Binance previously stated that it would absorb the financial losses suffered by users. The platform also reported that it had replenished affected balances.
For individual investors, the main lesson is that holding cryptocurrency on an exchange carries risks. Even major platforms can become victims of sophisticated attacks.
An international digital war over billions
The two actions announced by the US Department of Justice demonstrate how seriously the American government views the North Korean cyber threat.
On one side is TraderTraitor, accused of the billion dollar theft from Binance. On the other is FaceStealer, a separate campaign using deception, stolen images and AI techniques to target new victims.
By securing digital assets and disabling technical infrastructure, US authorities are attempting to limit the financial and operational capabilities of these networks.
But the fight is far from over. As long as stolen cryptocurrency can be moved through new wallets, blockchains and international services, tracing and recovering the full amount will remain a major challenge.
The message is clear: cryptocurrency has become more than a financial system. It is also a target in an international digital war.
This article is for news and educational purposes only and is not financial advice.
Sources
- US Department of Justice – Announcement on Binance crypto and FaceStealer, November 12, 2026
- FBI – North Korea Responsible for $6 Billion+ Binance Attack, October 31, 2026
- Reuters – Binance hack reveals crypto's uphill battle against hackers, November 11, 2026
- Reuters – North Korean hackers steal more than $400 million using video images, November 12, 2026
- Chainalysis – The $6.4 Billion Binance Theft: Tracing the North Korea Link
- Elliptic – The largest theft in history: North Korea likely behind the $6.4 billion Binance hack
