DOJ Gets Approval To Seize Or Restrain Over $1.2B From Binance Theft

The US Department of Justice said on 12th November 2026 that it had obtained court authorisation to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance. In its press release, the department attributed the theft of more than $6 billion around 29th October to North Korean military actors it identified as TraderTraitor.

The department said US government and private sector efforts had frozen more than $2.7 billion. The amount under court authority is part of that total, rather than an additional $1.2 billion. The announcement does not establish that those assets have been returned to Binance or its users.

Our earlier Binance report covers the initial impact estimates and freezes.

Binance's Coverage And Stolen Funds Are Separate

In a separate coverage notice, Binance said it had completed coverage of assets affected by the incident. It said it had committed more than $6.34 billion in company funds and had begun sourcing affected tokens.

The exchange described funding from its Secure Asset Fund for Users, an emergency user protection reserve, its Futures insurance fund, a reserve intended to cover shortfalls when losing futures trades are forcibly closed, and its corporate treasury. Binance said it used a portion of the Futures insurance fund above the level required under its risk-management framework. It said it would replenish the user protection fund to approximately $1 billion.

Binance also said withdrawals continued to reopen in phases. Its coverage announcement therefore does not mean every withdrawal service had resumed.

Investigators Continue To Trace The Assets

The DOJ said efforts to trace, freeze and seize stolen assets were continuing as the attackers laundered funds. The FBI's alert urges service providers to stop transactions with the listed addresses or arising from transactions with those addresses.

Chainalysis's tracing analysis on its company blog, first published on 30th October, explains one obstacle: it says attackers converted assets that issuers could freeze into cryptocurrencies beyond those issuers' control. The firm also attributed the attack to TraderTraitor, citing stolen Binance funds mixing with funds from an earlier theft attributed to North Korea.

Our laundering report explains the limits of freezing stolen tokens.

Separate Action Targets FaceStealer

The same DOJ announcement described the seizure of cloud infrastructure used in FaceStealer, a separate scheme that authorities said had stolen more than $400 million in cryptocurrency over 18 months.

According to the department, attackers used stolen communication accounts to invite targets into video meetings. They played recordings of trusted contacts or deepfakes, fabricated videos of industry figures, then claimed there was a technical problem. A supposed fix installed malicious software on the target's computer.

The FBI's FaceStealer hub says investigators seized more than 900 webcam videos of victims. It also says attackers increasingly targeted developers and maintainers of open source software, whose underlying code people can use, modify and share.

The FBI says the attackers sought access to their devices and accounts used to distribute software, which could let attackers spread malicious code.