Grant West had been jailed for fraud after carrying out attacks on brands such as Sainsbury's, Uber and Argos.
A police investigation, codename "Operation Draba", uncovered West's activity on the dark web under the moniker of "Courvoisier".
The confiscation order was made during a hearing at Southwark Crown Court.
West, from Sheerness, Kent, used phishing email scams to obtain the financial data of tens of thousands of customers.
He would then sell this personal data in different market places on the dark web, convert the profit made from selling financial details online into cryptocurrency, and store these in multiple accounts.
West, of Ashcroft Caravan Park, was jailed in May at Southwark Crown Court for 10 years and eight months.
Detectives had discovered evidence of West conducting cyber attacks on the websites of 17 major firms.
Following West's arrest, approximately £1m in cryptocurrency was seized from a number of his accounts. Taking currency fluctuations into account the currency is today valued at £922, 978.14.
The cryptocurrency will now be sold and the victims will receive compensation.
As well as financial data, he also sold cannabis which he shipped to customers, and "how to" guides instructing others how to carry out cyber attacks.
West also regularly used stolen credit card details to pay for items for himself, including holidays, food, shopping and household goods. West admitted conspiracy to defraud, possession of criminal property, unauthorised modification of computer material and various drugs offences.
