The US Department of Justice says it has frozen more than $2.7 billion in stolen crypto and has court authorization to seize or restrain over $1.2 billion of that.
In late October 2026, Binance reported losing $6.7 billion in a heist that played out over roughly 20 minutes. The attackers were TraderTraitor, a subset of North Korea's Lazarus Group. The money belonged to Binance, not its customers. The thieves pulled it from 10 chains, including Bitcoin, Ethereum, XRP, Solana and Arbitrum, then routed it through mixers, which are services that pool and shuffle coins to hide their trail.
The DoJ said federal teams worked with virtual asset service providers, meaning the exchanges and other firms that handle crypto, to interdict the funds. It did not say what freezing or seizing meant in practice, how it was done, or whether Binance will get any tokens back.
Separately, the DoJ said it disrupted cloud infrastructure behind FaceStealer, a scheme that allegedly took about $400 million over 18 months. A victim gets a video call on a fake Zoom page showing a recording stolen from a contact. There is no audio, and a prompt says a driver update will fix that. The driver is malware, typically an infostealer (software that harvests saved credentials) or a foothold into a wider network. The DoJ said FaceStealer was not used against Binance, but the method is almost identical to TraderTraitor's.
The arithmetic is mixed. If the frozen total all traces to this theft, it is roughly 40% of the haul, and the $1.2 billion under court order is about 18%. The source does not confirm that link, and most of the Binance money remains unaccounted for.
The more useful detail is how the attackers got in. After months of preparation, an employee was allegedly invited to a fake job interview and served malware, which gave the group its access. Hopping across 10 blockchains did not stop the freezes, which suggests the weak points for thieves are the firms that convert crypto to cash. The weak point for Binance was one person's device. How the group turned that foothold into the biggest crypto heist on record is still unexplained.