On 12 November 2026 the Justice Department announced two linked actions against North Korean cybercrime. The first concerns the theft of more than $6 billion in virtual assets from the Binance exchange on or about 29 October, which the FBI attributes to the North Korean military unit it calls TraderTraitor. The department said that "collective U.S. government and private sector efforts so far have resulted in the freeze of more than $2.7 billion," and that it had "already obtained court-authorization to seize or restrain in excess of $1.2 billion of that amount" (DOJ press release 26-1356). The second action disrupted cloud infrastructure behind a campaign called FaceStealer, which DOJ ties to more than $400 million in theft over 18 months.
The figures show something policymakers should take seriously: about 40% of the stolen funds were frozen, and that happened in days.
The case for tougher mandates
The strongest argument for stricter crypto rules is that most of the money still got out. Roughly $3.5 billion of the haul is not frozen. The FBI says TraderTraitor continues to launder through "cryptocurrency bridges, mixers, and exchanges." Elliptic told The Record that North Korean launderers create worthless tokens and route stolen assets through decentralized exchange liquidity pools, so that no funds pass directly between the source and destination wallets (The Record). Elliptic said the same technique was used after the roughly $1.5 billion Bybit theft in February 2025. Regulators who want mandatory transaction screening, licensed bridges, or restrictions on mixers can point out that voluntary cooperation recovered only part of the money, and that the regime uses the rest to "fund its illicit weapons program," in the words of FBI Cyber Branch Operations Director Brett Leatherman.
That argument deserves weight. It also has a gap.
What actually worked
The freezes did not come from a new statute. They came from relationships. Assistant Attorney General A. Tysen Duva credited the Criminal Division's role as the department's liaison to the digital asset industry for its ability to "immediately halt about half of this historic breach" (The Record). Binance's former chief executive Changpeng Zhao said US law enforcement helped trace and freeze the funds, and the FBI, Secret Service and IRS asked exchanges to block transactions derived from TraderTraitor addresses (The Record, 2 November).
This is the same model the FBI used after Bybit. Its February 2025 public service announcement attributed the roughly $1.5 billion theft to TraderTraitor and published a list of Ethereum addresses for exchanges, bridges and node operators to block (FBI IC3 PSA I-022625). Publishing indicators, naming the actor and keeping a trusted channel to industry is cheap and fast, and it adapts as the attacker changes tactics. A statutory mandate is slower to write and tends to fix a technical definition that attackers then route around.
The laundering behavior described above also cuts against blunt mandates. Attackers who mint disposable tokens and pass them through liquidity pools are not stopped by rules written for named mixers or specific bridges. Rules that bind lawful developers and users, who far outnumber the criminals, would be easy for North Korea to evade. Enforcement aimed at the actor and its cash-out points, with court orders over the assets, directly addresses the problem.
FaceStealer is a developer-security story
The second action matters as much as the first. According to The Record's account of the FBI briefing, FaceStealer sends Calendly invitations to Zoom or Teams meetings from accounts stolen from earlier victims. It delivers malware through fake domains, then plays recordings of past victims to simulate a crowded call, and tells the target a fake technical fault needs fixing. The "fix" installs a cookie harvester, keyloggers and a backdoor. The FBI said it seized more than 900 webcam videos of victims, and DOJ confirms the same figure.
The targets include crypto industry staff and open-source developers. The FBI knows of attempts against maintainers of npm packages and, more recently, Rust crates. An FBI agent told The Record it is unclear whether FaceStealer was used against Binance, so the two actions should not be read as a single campaign. DOJ itself describes the FaceStealer campaign as separate.
The remedy here is hygiene, not regulation. Maintainers should treat meeting invitations from known contacts as untrusted, run calls on isolated devices, and use hardware-backed credentials. A trusted-contact attack succeeds because it exploits trust, and no licensing regime fixes that. Platform providers can help by warning users about links and by taking down abused infrastructure quickly. Those are product decisions.
A proportionate policy agenda
Congress and agencies should lock in what worked and resist the reflex to add mandates:
- Fund the industry liaison model. The Criminal Division's cryptocurrency expertise produced the freezes. Dedicated staffing and 24/7 channels with exchanges are inexpensive compared with the sums involved.
- Publish indicators faster and in machine-readable form. The Bybit-era address lists helped; automated feeds to exchanges and analytics firms would shorten the window for laundering.
- Protect safe harbors for good-faith freezes. Exchanges that freeze funds on suspicion need legal clarity so that cooperation does not create liability.
- Keep enforcement aimed at state actors. Sanctions, forfeiture and infrastructure takedowns target the regime. Broad restrictions on privacy tools or open-source code mostly burden lawful users.
The $2.7 billion freeze is not a victory yet. DOJ says tracing, freezing and forfeiture are ongoing, and the release names no arrests or charged individuals. But it is evidence that a fast, voluntary, well-staffed partnership between government and industry can claw back billions without rewriting the rules for the open internet. The policy priority is to scale that partnership, not replace it.