US obtains court authority over $1.2 billion in Binance hack funds

What happened

The U.S. Justice Department said it has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency taken from Binance, according to reports from Bitcoin Magazine and Blockonomi. The department described the order as part of a broader freeze exceeding $2.7 billion, a combined figure covering U.S. government and private-sector efforts. Officials said the action was announced on Nov. 12, roughly two weeks after the exchange disclosed the theft. The Justice Department did not publish the underlying court papers with its announcement, and it said the $1.2 billion is included in the larger freeze rather than an additional amount.

The FBI has attributed the Oct. 29 breach to North Korean military actors it calls TraderTraitor. The Justice Department put the value of assets stolen in the attack at more than $6 billion, while Binance has estimated the loss at $6.34 billion. On Oct. 31, the FBI, working with the Secret Service and IRS Criminal Investigation, issued a cyber alert naming North Korea and asking virtual asset service providers to block transactions tied to addresses used by the actors. Investigators said the stolen assets were being converted mainly into ether. Blockonomi reported that North Korea has denied involvement.

Binance said attackers reached an internal wallet-signing service and started transfers outside its normal withdrawal process. Its account described a multistage operation involving fake job interviews, malware downloads and compromised internal tools. On Nov. 12, the exchange said it had completed coverage of the affected assets using company resources, including its Secure Asset Fund for Users, part of its futures insurance fund and its treasury. It also published a new reserve snapshot, though the accompanying cryptographic proof was still pending. Replacing customer assets is separate from recovering the stolen coins.

Why it matters

The court authorization matters because it moves frozen funds closer to forfeiture. According to Bitcoin Magazine, the $1.2 billion is not newly recovered money; it comes out of roughly $2.85 billion that Binance said on Nov. 3 had already been frozen or intercepted. Until the court step, those assets had been frozen at token issuers. Seizure or restraint gives the government a legal route toward ownership, but it does not mean the funds have been returned to users or that all stolen crypto has been located. The Justice Department said TraderTraitor actors continue moving assets through bridges, mixers and exchanges, so tracing and forfeiture work is ongoing. Officials described the wider freeze as halting about half of the breach before the assets moved beyond law enforcement reach.

What the data shows

The figures reported so far describe different stages of the case. The theft was valued at more than $6 billion by the Justice Department and $6.34 billion by Binance. The overall freeze is more than $2.7 billion. The amount under court authorization is more than $1.2 billion, drawn from the roughly $2.85 billion Binance said had been frozen or intercepted. The Justice Department did not specify how much of either the $2.7 billion freeze or the $1.2 billion court-authorized total is bitcoin. The FBI said the attackers were converting assets primarily into ether.

Background

Binance disclosed the breach after the Oct. 29 attack, and the FBI's Oct. 31 alert followed quickly. U.S. officials have linked cryptocurrency theft to North Korea's government and weapons programs. In a separate enforcement action announced the same week, the U.S. attorney's office in the Central District of California and the FBI said they had seized cloud infrastructure used in a social engineering campaign called FaceStealer. The FBI said that scheme stole more than $400 million in cryptocurrency over 18 months and also targeted maintainers of open-source software, raising concerns about supply-chain attacks. The Binance case is being handled by the FBI's Los Angeles Field Office, Cyber Division and Virtual Asset Unit, with the Secret Service and IRS-CI.

What to watch

Investigators are still watching how the stolen Binance assets move. The Justice Department said the actors are using bridges, mixers and exchanges, which can complicate tracing. The FBI's FaceStealer advisory adds another warning: attackers lured targets through imposter versions of Zoom, Microsoft Teams and Google Meet, often using invitations sent from hijacked Telegram, LinkedIn, Slack or Discord accounts. The bureau said the hackers played prerecorded webcam videos of people the targets knew or deepfakes of well-known crypto figures, then introduced a fake technical problem and sent a supposed fix that installed malware. In several cases, the theft came months to more than a year after the first compromise, as the hackers waited for wallet balances to grow. Under a federal warrant, the FBI seized more than 900 webcam videos of victims. It has posted information at fbi.gov/facestealer. Authorities have not said how much of the frozen Binance total may eventually be forfeited or returned.

Questions readers ask