The U.S. Federal Bureau of Investigation (FBI) has seized more than $1.2 billion worth of cryptocurrency stolen from Binance, the world’s largest cryptocurrency exchange. The agency also disrupted a separate hacking operation that allegedly resulted in the theft of more than $400 million in cryptocurrency over the past 18 months.
The Binance-related theft, estimated at approximately $6.3 billion, has been attributed to a North Korean hacking group known as TraderTraitor. The FBI described it as the largest cryptocurrency heist in history. Following the attack, U.S. authorities and private-sector cryptocurrency companies moved to trace and freeze the stolen assets.
READ: Crypto industry spends $189 million on US elections (June 30, 2026)
According to the FBI, the U.S. government and private-sector partners have collectively frozen more than $2.7 billion in stolen funds. The Department of Justice has obtained court authorization to seize or restrain more than $1.2 billion of that amount.
Investigators are continuing to track the remaining assets as hackers attempt to move them through cryptocurrency exchanges, blockchain bridges and mixing services to conceal their origins.
Binance co-CEO Richard Teng said withdrawals surged during the first 24 hours of the incident, which he described as “expected,” before returning to normal levels. He also maintained that the company remained in “very strong financial health” and had “replenished 95% of the affected tokens.”
Alongside the ongoing investigation, the FBI also announced action against another North Korean-linked operation known as FaceStealer, which allegedly stole more than $400 million in cryptocurrency.
FaceStealer reportedly relied on manipulating personal and professional relationships to gain access to victims’ devices and digital assets. The operation used fake versions of popular video conferencing platforms, including Zoom, Microsoft Teams and Google Meet, that were controlled by hackers.
Targets were lured into fraudulent video meetings through invitations sent from legitimate communication and social media accounts that had been hijacked from previous victims. Once participants joined the meetings, hackers fabricated technical problems and directed them to download malicious software disguised as troubleshooting tools.
The FBI said it had identified and seized more than 900 webcam videos of victims that hackers allegedly used to impersonate them in subsequent attacks.
“Cryptocurrency unfortunately has become fertile ground for North Korea to defraud victims and fund its malign activities,” said First Assistant U.S. Attorney Bill Essayli for the Central District of California. “Today’s seizure shows that America will continue the fight against rogue states who financially gain from cybercrime.”
READ: Crypto Exchange unveils marketplace where AI agents can hire each other (June 30, 2026)
“The North Korean regime may think they are sophisticated cyber criminals, but we have consistently met them head on, as we did here seizing more than $1.2 billion of their stolen assets,” said U.S. Attorney Jeanine Ferris Pirro.
Cryptocurrency remains an attractive target for cybercriminals because digital assets can move across international borders quickly. Transactions routed through multiple platforms can also make it difficult for investigators to identify the individuals controlling the funds. North Korean representatives have repeatedly denied allegations of involvement in cryptocurrency thefts.