Binance Hack Seizure: DOJ Targets $1.2 Billion

The Binance hack is now the target of a U.S. court-authorized seizure or restraint covering more than $1.2 billion in cryptocurrency, the Justice Department announced on November 12. The action is part of a wider effort against North Korean-linked crypto theft that also included a separate operation targeting FaceStealer.

The order doesn’t cover the full reported haul. U.S. authorities and private-sector firms have frozen more than $2.7 billion, while blockchain tracking cited by BeInCrypto indicates billions more may remain accessible or have moved through laundering routes.

• The DOJ says the Binance theft happened on or about October 29, 2026, and involved more than $6 billion in virtual assets.
• The FBI attributes the attack to North Korean military actors called TraderTraitor. North Korea denies involvement, according to the Associated Press.
• The more than $1.2 billion covered by the court authorization is part of a larger pool of frozen assets, not the total stolen amount.
• The DOJ also moved against cloud infrastructure linked to FaceStealer, a separate scheme that the FBI says used recorded webcam videos and deepfakes.
• Binance says it replaced the assets lost in the incident with funds from its treasury and insurance resources.

Binance hack seizure timeline

1. October 29, 2026: The DOJ says the Binance theft occurred on or about this date and attributes it to TraderTraitor, which the FBI links to North Korean military actors.
2. November 6: Elliptic, as reported by BeInCrypto, tracked about 1,650 bitcoin moving into new addresses. Some later reached the Tornado Cash mixer, the firm said.
3. November 10: Onchain Lens published an estimate based on Arkham Intelligence data: about $6.34 billion in total, with roughly $2.85 billion still accessible, $2.60 billion frozen and $891 million potentially moved or laundered.
4. November 12: The DOJ announced court authorization to seize or restrain more than $1.2 billion tied to the hack, alongside an action targeting cloud infrastructure used in FaceStealer.
5. November 13: BeInCrypto reported that tracing and recovery remained underway as funds moved across bridges, mixers and exchanges. These are changing estimates, not a final accounting.

Background: what the Binance hack seizure covers

The DOJ describes the Binance hack as a theft of more than $6 billion in virtual assets. By November 12, investigators and private-sector partners had frozen more than $2.7 billion. The court-authorized action targets more than $1.2 billion within that broader effort. The DOJ announcement describes authorization to seize or restrain the assets; it does not say the full amount has been forfeited or returned.

The figures are separate snapshots. Onchain Lens, cited by BeInCrypto, estimated the haul at about $6.34 billion, with around $2.85 billion still accessible. BeInCrypto reported that attackers used cross-chain protocols including THORChain and Chainflip. The DOJ said laundering through bridges, mixers and exchanges complicates recovery.

BeInCrypto reported that the hackers moved funds through THORChain and Chainflip in recent days. The DOJ said laundering through bridges, mixers and exchanges complicates tracing and recovery.

The separate FaceStealer action doesn’t concern the Binance theft. The FBI said the scheme stole more than $400 million in cryptocurrency over the preceding 18 months and investigators identified and seized more than 900 webcam videos used to impersonate victims. The FBI said operators hijacked messaging accounts to invite targets to fake video meetings, then used a staged technical issue to persuade them to install malware. The DOJ said operators increasingly targeted open-source developers and maintainers to access their devices and repository accounts, potentially enabling software supply-chain attacks.

Reactions and market context

Principal Deputy Assistant Attorney General M. Scott Proctor said North Korea uses crypto theft to fund its government and illicit weapons program. The DOJ says it will use available tools to seize and return proceeds. Assistant Attorney General Tysen Duva, quoted by BeInCrypto, credited the Criminal Division with quickly halting about half of the breach through early freezes.

Binance said it replaced every token lost in the incident using treasury and insurance funds and announced a new proof-of-reserves snapshot. That’s the exchange’s statement about customer coverage; the DOJ separately said its tracing and recovery efforts continue.

North Korea rejected the U.S. attribution. The Associated Press reported that Kim Yo Jong called it a “trite provocation” and “absurd rhetoric.” The Block focused on the court authorization and FaceStealer disruption, while BeInCrypto highlighted the estimated amount that may still be accessible.

Crypto prices were lower on November 13, but available data doesn’t show that the DOJ announcement caused the decline. CoinGecko figures below are for 06:13 UTC that day. The Crypto Fear & Greed Index was 20, classified as Extreme Fear, on November 13, according to Alternative.me.

The declines provide context, not evidence of a direct response to the seizure news. Binance said it replaced every token lost in the incident from its treasury and insurance funds.

Outlook: what to watch next

The next test is whether investigators can turn frozen assets into legally forfeited funds and return them. The DOJ hasn’t announced that the full $1.2 billion has been recovered or distributed. The DOJ said tracing and recovery continue as the actors launder funds through bridges, mixers and exchanges.

BeInCrypto reported that the FBI, Secret Service and IRS Criminal Investigation urged crypto service providers to block addresses associated with laundering. Onchain Lens questioned whether attackers could move another $1 billion before THORChain and Chainflip restricted linked wallets. That was the analytics firm’s concern, not a confirmed outcome.

Binance’s stated replacement of lost assets is separate from the seizure amount. The DOJ said tracing and recovery efforts continue as the actors launder funds through bridges, mixers and exchanges.

FAQ

How much from the Binance hack can the DOJ seize?

On November 12, the DOJ said it had court authorization to seize or restrain more than $1.2 billion in stolen cryptocurrency. Government and private-sector freezes exceeded $2.7 billion.

Who does the FBI say was behind the Binance hack?

The DOJ says the FBI attributed the theft to North Korean military actors known as TraderTraitor. North Korea denied involvement, according to the Associated Press.

Is FaceStealer part of the Binance hack?

No. The DOJ described FaceStealer as a separate disruption. The FBI said the scheme used recorded webcam footage or deepfakes and malware to steal cryptocurrency.

Sources

• US Moves to Seize $1.2 Billion From Binance Hack. Where Is the Rest? (BeInCrypto)
• DOJ moves to seize $1.2 billion from Binance hack, disrupts North Korean deepfake scheme (The Block)
• Justice Department Announces Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency (www.justice.gov)

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.