The US Department of Justice announced on November 12, 2026, that it obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency allegedly stolen from Binance by North Korean state-sponsored hackers, marking one of the largest single crypto enforcement actions in US history.
What the Justice Department Says Is Covered by Orders
According to the DOJ press release, federal prosecutors in the District of Columbia secured court-authorized seizure and restraint orders covering more than $1.2 billion in virtual assets tied to the Binance breach. The action represents a coordinated effort spanning the DOJ, FBI, Secret Service, and IRS Criminal Investigation divisions. For related coverage, see Which Crypto ETF Got the Most Inflows Last Week? Not Bitcoin or Ethereum.
When combined with freezes executed by US government and private-sector partners, the total assets taken out of circulation exceeded $2.7 billion, according to the DOJ announcement. Assistant Attorney General A. Tysen Duva described the operation as “immediately freezing billions of dollars’ worth of stolen Binance digital assets before they got beyond law enforcement reach.” Context on this theme: South Korea Crypto Tax 2027: 22% Above 2.5M Won.
For related context, see coverage of a reported FBI crypto seizure.
Alleged Link to Binance and North Korean Actors
The DOJ alleges the underlying theft occurred on or about October 29, 2026, when North Korean military unit TraderTraitor allegedly stole more than $6 billion in virtual assets from Binance, making it the largest exchange hack on record. TraderTraitor operates under a network of aliases including Sapphire Sleet, BlueNoroff, APT38, UNC1069, Dangerous Password, CryptoCore, and Stardust Chollima, according to the DOJ press release.
According to unconfirmed reports cited by The Record, investigators believe the hackers gained initial access through an employee’s device after months of preparation, though this method was not confirmed in the DOJ’s official statement. A single source also reported that Kim Yo Jong, sister of North Korean leader Kim Jong Un, issued a denial of North Korea’s involvement on November 3, 2026, though this claim has not been independently verified.
Blockchain analytics firm Elliptic tracked laundering activity across approximately 12,000 wallets on 11 blockchains, involving more than 40,000 transactions, according to data cited by The Record. In a novel technique also observed in the $1.4 billion Bybit hack, North Korea allegedly created at least six meme coins on the NEAR blockchain between November 5 and 7 to cycle stolen funds through decentralized exchange liquidity pools, obscuring the trail.
FBI Cyber Branch Operations Director Brett Leatherman stated in the DOJ announcement: “The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years.”
FaceStealer Operation and Systemic Developer Risk
Alongside the Binance recovery, the DOJ announced disruption of a separate operation attributed to APT38, the same North Korean threat cluster. The FaceStealer campaign allegedly stole more than $400 million in cryptocurrency over 18 months, using AI-generated deepfakes and fake video calls to deceive victims. The FBI separately seized more than 900 webcam videos of victims as part of the FaceStealer investigation, with warrants executed in the Central District of California covering cloud infrastructure seizures.
What has received less mainstream coverage is the supply chain dimension of FaceStealer: North Korean actors allegedly targeted open-source JavaScript and Rust crate maintainers to embed malicious code in widely used developer libraries. This systemic risk to developer infrastructure goes beyond individual victims and touches anyone who depends on affected packages. For related coverage, see a reported $8.3 million XRP and Bitcoin seizure from a cyber negotiator.
Market Impact and Enforcement Context
BNB, Binance’s native token, fell 7.46% in 24 hours to $588.37, with a market cap of approximately $77.38 billion, according to CoinGecko data as of November 9, 2026.
For related coverage, see a reported Ireland CAB seizure of 500 BTC with Europol support.
For the creator economy and digital ownership infrastructure, the broader implication sits in the supply chain threat. NFT platforms, marketplaces, and token-gating protocols that rely on open-source JavaScript dependencies are directly exposed to the developer-targeting tactics attributed to FaceStealer. As North Korean actors evolve from exchange hacks to poisoning the tooling developers use to build Web3 infrastructure, platform security reviews will need to extend well below the smart contract layer.
Editorial credits
Checked by NFTenex QC Team before publishing on November 14, 2026 for headline accuracy, original value, factual consistency, metadata, commercial disclosure and authorship claims: our AI review system checks every article before it goes live, and our duty editor monitors it after publication. Report an error.
NFTenex uses AI for research, drafting and review. Our editorial team is responsible for every article and corrects or withdraws articles when needed. How we review.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
