EL7.AI
CryptoMedium•12 November 2026•
4 min read

Washington Freezes More Than $2.7 Billion in Stolen Assets, Secures Authorization to Seize $1.2 Billion

Key Facts

1The U.S. government and private sector froze more than $2.7 billion in stolen assets, and the department obtained court authorization covering more than $1.2 billion as of November 12, 2026.
2The Justice Department attributed the theft to members of the North Korean military, said it took place around October 29 and valued it at more than $6 billion.
3Binance said 98% of the affected assets had been returned by October 31, 2026, and that about $2.85 billion in assets had been frozen or intercepted in its November 3 update.
4The department said the FaceStealer campaign stole more than $400 million during the 18 months before its November 12, 2026 announcement.

The U.S. Justice Department said on November 12 that it had obtained court authorization to seize or restrict digital assets worth more than $1.2 billion, out of more than $2.7 billion in stolen assets that the U.S. government and private sector said they had frozen. The amount covered by the authorization represents part of the total frozen assets and does not mean the money has already been returned to its owners. The department linked the action to a theft it said was carried out by members of the North Korean military, whom the Federal Bureau of Investigation knows as "TraderTraitor." It estimated the value of the stolen assets at more than $6 billion. An official said in the department's statement that authorities and law enforcement partners quickly froze billions of dollars in stolen Binance assets before they could move beyond their reach.

According to the department, the theft took place around October 29 and was attributed to members of the North Korean military. The account places the operation within the activity of a group U.S. authorities call "TraderTraitor," while the actions announced by the department began by pursuing some of the assets through freezing and court authorization to seize or restrict them. The difference between the two amounts is material to describing the status of the funds: more than $2.7 billion was frozen through government and private-sector efforts, while the amount for which the department obtained court authorization exceeded $1.2 billion. The department's statement did not say the court action had completed the recovery process. The department also said tracing, freezing and seizure efforts remain underway.

The department said laundering of the stolen assets was continuing through cryptocurrency bridges, mixing services and platforms. It said efforts to trace, freeze, seize and forfeit the assets had not yet ended. The court authorization therefore remains one step in a broader legal process, as work to identify the assets and take action against them continues. The Associated Press reported that the usual procedure in such cases is for the government to file a forfeiture claim with a judge. The judge then determines who has legitimate claims to the recovered money. This process, by itself, does not mean the money has reached its owners or that all claims have been resolved.

On the platform side, Binance said it had completed coverage for the assets affected by the incident. It said it used a combination of the SAFU fund, a futures insurance fund and the company's treasury to finance the coverage. In an earlier update, the platform said 98% of the affected assets had been returned by October 31. It also estimated the value of digital assets frozen or intercepted at about $2.85 billion as of its November 3 update, with the estimate subject to reconciliation and price fluctuations. Binance said the attacker exploited unauthorized access to an internal wallet-signing service to execute transactions outside the usual withdrawal process. It said five hot wallets sent 233.46 million XRP to an address controlled by the attacker within four minutes, between 20:05 and 20:09 UTC.

The Justice Department distinguished the Binance theft case from the FaceStealer campaign, for which it announced the disruption of cloud infrastructure used in the operation. The department said the campaign stole more than $400 million in cryptocurrency during the 18 months before its announcement on November 12. It described a method relying on covert video recordings and deepfakes, with victims lured into video meetings through accounts stolen from previous victims. In the separate investigation, the FBI seized more than 900 webcam videos under a federal warrant. The actions represent two distinct strands of a U.S. crackdown on thefts linked to North Korea: pursuing assets tied to the Binance hack and disrupting infrastructure used in FaceStealer. The department did not link the FaceStealer campaign to the Binance hack.

Binance had said in its update that the attack targeted its hot wallets, while on November 12 it announced a new proof-of-reserves snapshot covering 198 tokens. It added that producing the full zero-knowledge proof could take about 40 to 50 hours, and that withdrawals were resuming in stages. The U.S. forfeiture proceedings remain separate from Binance's coverage of the affected assets: the former concerns freezing funds and pursuing them through the courts, while the platform said it financed coverage of the incident's losses from its own resources and funds. In its account of the court process, the Associated Press said the government would typically file a forfeiture claim with a judge to determine who has a legitimate claim to the recovered money. The Justice Department says efforts to trace, freeze, seize and forfeit the assets remain underway.