Binance Hack: DOJ Secures Orders Covering Over $1.2B

The US Department of Justice (DOJ) has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, marking a significant legal development following the October exchange hack.

Announced on November 12, the action covers part of more than $2.7 billion already frozen through coordinated government and private-sector efforts. The $1.2 billion is included within that total and does not represent an additional recovery.

The development brings renewed attention to a distinction central to the exchange’s response: replacing affected assets with company resources and recovering stolen cryptocurrency are separate processes.

From emergency freezes to legal recovery

The FBI attributed the theft of more than $6 billion from Binance around October 29 to North Korean activity it calls TraderTraitor.

In its October 31 alert, the bureau said attackers were converting stolen assets primarily into Ether and were expected to use decentralized finance and instant-swap services for further laundering. Authorities urged exchanges, infrastructure operators and other service providers to block transactions involving identified addresses or funds derived from them.

The DOJ says tracing, freezing, seizure and forfeiture efforts remain underway. Its announcement does not specify when assets covered by the court authorization could be returned or provide a token-by-token breakdown of that amount.

Court-authorized seizure or restraint does not establish final ownership. The FBI’s explanation of civil judicial forfeiture distinguishes seizure from the proceedings through which the government must establish that property is connected to criminal activity.

Stopping stolen assets from moving is therefore an essential intervention, while completing recovery requires further legal steps.

Replacing assets and recovering stolen funds

Following the breach, Binance committed more than $6.34 billion in company resources to cover its financial impact. That allocation was separate from stolen assets frozen through industry cooperation, as detailed in our earlier coverage of the hack and Binance’s response.

The distinction matters when assessing progress. An exchange can use its own resources to replace affected holdings while authorities continue pursuing the stolen cryptocurrency.

The broader questions surrounding Binance after the hack—including financial resilience, governance and security controls—also remain relevant. The court action advances the recovery process, while preventing another breach requires changes to the systems and controls protecting assets.

FaceStealer disruption targets a separate campaign

Alongside the Binance announcement, authorities disclosed the disruption of cloud infrastructure supporting FaceStealer, a separate North Korean social-engineering campaign. The DOJ explicitly describes the Binance theft separately; its announcement does not establish FaceStealer as the method used to breach the exchange.

According to the FBI’s November 12 technical report, FaceStealer actors stole more than $400 million in cryptocurrency over 18 months.

Attackers use hijacked messaging accounts to invite victims’ contacts to fake video meetings. They play previously recorded footage of familiar people, introduce a supposed audio problem and persuade the target to install a “fix” that delivers malware.

The FBI seized more than 900 victim webcam recordings. While attackers also use deepfakes, the bureau says the campaign still overwhelmingly relies on genuine stolen video. Its targets increasingly include open-source software maintainers, potentially exposing systems beyond the individual victim’s device.

The next test is completing recovery

The challenge extends across finance. As discussed in our coverage of the Arkéa cyberattack, public blockchain records can help reveal suspicious movements, but tracing money does not guarantee its recovery. Intervention depends on reaching organizations with the ability and authority to stop it.

For institutions handling digital assets, these cases suggest that recovery arrangements deserve scrutiny alongside preventive security: who can act, how quickly evidence can be shared, and how emergency restrictions can be supported by legal orders.

For Binance, the next measurable milestones are how much of the frozen pool proceeds through legal recovery, how much is ultimately returned, and what safeguards reduce the risk of another breach.