DOJ says over $1.2 billion in stolen Binance crypto is under seizure or restraint orders

The U.S. Justice Department says it has obtained court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance. The November 12 announcement reports progress in blocking access to stolen funds, but it does not say that the full amount has been returned to victims.

The department places that amount within more than $2.7 billion frozen through joint government and private-sector efforts. The two totals overlap. Adding them would overstate the amount affected by the response. Source: Justice Department announcement.

The FBI has attributed the late-October theft to North Korean actors it calls TraderTraitor. That attribution is the U.S. government's assessment. The agency's October 31 alert described more than $6 billion in assets stolen from the exchange on or about October 29.

What the figures actually measure#

The three headline amounts describe different stages and scopes. The theft estimate covers the incident. The frozen total covers assets whose movement has been blocked. The court-authorized figure covers a portion subject to seizure or restraint authority.

Measure	Reported amount	Important distinction
Assets stolen	More than $6 billion	FBI incident estimate
Assets frozen	More than $2.7 billion	Joint public-private efforts
Seizure or restraint authority	More than $1.2 billion	Included in frozen total

Sources: FBI's October 31 alert and DOJ's November 12 update. These are reported dollar values, not a matched set of balances measured at one disclosed market-price snapshot.

A precise recovery percentage cannot be calculated from those lower-bound figures. Nor does freezing an asset settle who ultimately receives it. DOJ says tracing, freezing, seizure and forfeiture work continues.

Investigators are following conversions#

The FBI said investigators had observed the attackers converting stolen assets mainly into Ether. Its alert asked exchanges, analytics firms and other service providers to block transactions involving listed addresses or funds derived from them.

That request illustrates why the response extends beyond Binance. A theft can leave an exchange and then pass through other assets and services. A useful intervention may occur later, when the funds encounter a provider able to restrict them.

DOJ says investigators are working with virtual-asset service providers while the attackers continue to move funds through bridges, mixers and exchanges. The department names the FBI, Secret Service and IRS Criminal Investigation among the agencies involved.

1. 2026-10-29Approximate theft date identified by the FBI
2. 2026-10-31FBI attributes the attack and publishes wallet addresses
3. 2026-11-12DOJ reports frozen assets and court-authorized seizure or restraint

Source: FBI alert, DOJ update

A separate campaign was disrupted#

The same DOJ announcement also describes action against FaceStealer, a separate social-engineering campaign. Its reported losses should not be folded into the Binance theft total.

In a November 12 advisory, the FBI says FaceStealer uses fake video meetings and recordings of trusted contacts. Targets are told to fix an apparent technical problem; the supposed fix installs malware.

The FBI says the campaign stole more than $400 million over 18 months and also targeted open-source software maintainers. It reports seizing more than 900 victim webcam videos used in the scheme.

The cases show two different parts of the crypto-security problem: protecting access before a theft and coordinating restrictions after funds move. The new Binance figures describe the second task. Further official updates will be needed to establish how much is forfeited and ultimately restored, rather than only frozen or placed under court authority.

Written and source-checked with AI assistance. No independent human fact-check has been recorded.

Photo: VOA, Public domain. Cropped for display.

{{cite news |title=DOJ says over $1.2 billion in stolen Binance crypto is under seizure or restraint orders |url=https://567business.com/news/doj-binance-crypto-seizure-restraint-1-2-billion-november-2026 |work=567 Business |author=567 Business |date=2026-11-13 |language=en}}

{
  "id": "https://567business.com/news/doj-binance-crypto-seizure-restraint-1-2-billion-november-2026",
  "type": "article-newspaper",
  "title": "DOJ says over $1.2 billion in stolen Binance crypto is under seizure or restraint orders",
  "URL": "https://567business.com/news/doj-binance-crypto-seizure-restraint-1-2-billion-november-2026",
  "container-title": "567 Business",
  "language": "en",
  "author": [
    {
      "literal": "567 Business"
    }
  ],
  "issued": {
    "date-parts": [
      [
        2026,
        11,
        13
      ]
    ]
  }
}

<iframe src="https://567business.com/embed/news/doj-binance-crypto-seizure-restraint-1-2-billion-november-2026?theme=auto" title="DOJ says over $1.2 billion in stolen Binance crypto is under seizure or restraint orders by 567 Business" width="100%" height="440" style="border:0;max-width:100%" loading="lazy"></iframe>
<p style="font-size:14px">DOJ says over $1.2 billion in stolen Binance crypto is under seizure or restraint orders by <a href="https://567business.com/news/doj-binance-crypto-seizure-restraint-1-2-billion-november-2026" rel="nofollow">567 Business</a></p>
<script async src="https://567business.com/embed.js"></script>