{"schema_version":1,"citation_url":"https://567business.com/news/doj-binance-crypto-seizure-restraint-1-2-billion-november-2026","title":"DOJ says over $1.2 billion in stolen Binance crypto is under seizure or restraint orders","description":"The court-authorized amount is part of more than $2.7 billion frozen, not an additional recovery.","author":"567 Business","publisher":"567 Business","date_published":"2026-11-13T16:55:44.808097Z","date_modified":"2026-11-13T16:55:44.808097Z","body_markdown":"The U.S. Justice Department says it has obtained court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance. The November 12 announcement reports progress in blocking access to stolen funds, but it does not say that the full amount has been returned to victims.\n\nThe department places that amount within more than $2.7 billion frozen through joint government and private-sector efforts. The two totals overlap. Adding them would overstate the amount affected by the response. [Source: Justice Department announcement](https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency).\n\nThe FBI has attributed the late-October theft to North Korean actors it calls TraderTraitor. That attribution is the U.S. government's assessment. The agency's October 31 alert described more than $6 billion in assets stolen from the exchange on or about October 29.\n\n## What the figures actually measure\n\nThe three headline amounts describe different stages and scopes. The theft estimate covers the incident. The frozen total covers assets whose movement has been blocked. The court-authorized figure covers a portion subject to seizure or restraint authority.\n\n| Measure | Reported amount | Important distinction |\n| --- | ---: | --- |\n| Assets stolen | More than $6 billion | FBI incident estimate |\n| Assets frozen | More than $2.7 billion | Joint public-private efforts |\n| Seizure or restraint authority | More than $1.2 billion | Included in frozen total |\n\nSources: [FBI's October 31 alert](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) and DOJ's November 12 update. These are reported dollar values, not a matched set of balances measured at one disclosed market-price snapshot.\n\nA precise recovery percentage cannot be calculated from those lower-bound figures. Nor does freezing an asset settle who ultimately receives it. DOJ says tracing, freezing, seizure and forfeiture work continues.\n\n## Investigators are following conversions\n\nThe FBI said investigators had observed the attackers converting stolen assets mainly into Ether. Its alert asked exchanges, analytics firms and other service providers to block transactions involving listed addresses or funds derived from them.\n\nThat request illustrates why the response extends beyond Binance. A theft can leave an exchange and then pass through other assets and services. A useful intervention may occur later, when the funds encounter a provider able to restrict them.\n\nDOJ says investigators are working with virtual-asset service providers while the attackers continue to move funds through bridges, mixers and exchanges. The department names the FBI, Secret Service and IRS Criminal Investigation among the agencies involved.\n\n```diagram\ntype: timeline\ntitle: The official Binance theft response timeline\nsource: [FBI alert](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack), [DOJ update](https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency)\n---\n2026-10-29: Approximate theft date identified by the FBI\n2026-10-31: FBI attributes the attack and publishes wallet addresses\n2026-11-12: DOJ reports frozen assets and court-authorized seizure or restraint\n```\n\n## A separate campaign was disrupted\n\nThe same DOJ announcement also describes action against FaceStealer, a separate social-engineering campaign. Its reported losses should not be folded into the Binance theft total.\n\nIn a [November 12 advisory](https://www.ic3.gov/CSA/2026/261112.pdf), the FBI says FaceStealer uses fake video meetings and recordings of trusted contacts. Targets are told to fix an apparent technical problem; the supposed fix installs malware.\n\nThe FBI says the campaign stole more than $400 million over 18 months and also targeted open-source software maintainers. It reports seizing more than 900 victim webcam videos used in the scheme.\n\nThe cases show two different parts of the crypto-security problem: protecting access before a theft and coordinating restrictions after funds move. The new Binance figures describe the second task. Further official updates will be needed to establish how much is forfeited and ultimately restored, rather than only frozen or placed under court authority.\n\n*Written and source-checked with AI assistance. No independent human fact-check has been recorded.*\n\n*Photo: [VOA](https://commons.wikimedia.org/wiki/File:US_Department_of_Justice_building_with_road.jpg), Public domain. Cropped for display.*","link_base":"https://567business.com/news/doj-binance-crypto-seizure-restraint-1-2-billion-november-2026","citation_guidance":"Cite citation_url. Preserve source links, dates and qualifications. date_modified is an edit date, not proof that every claim was rechecked. Third-party images and quoted material retain their own rights."}