Binance update: US court authorises seizure or restraint of more than $1.2 billion in stolen assets, with more than $2.7 billion frozen
The US Justice Department said on November 12, 2026 that a court has authorised it to seize or restrain more than $1.2 billion stolen from Binance.
What happened
We first flagged this on October 29, 2026 — here’s what changed. Update Nov 13, 2026, 08:00 ET: Added the US Justice Department’s November 12 announcement — court authorisation to seize or restrain more than $1.2 billion of the stolen assets, an official frozen total of more than $2.7 billion, and Binance’s statement that its coverage of the affected assets is now complete. In that announcement, the Justice Department said that on or about October 29, members of the North Korean military, referred to by the FBI as “TraderTraitor,” stole more than $6 billion worth of virtual assets from Binance — the figure is the Department’s wording; Binance’s own figure for the theft is about $6.3 billion. Since the theft, the Department, the FBI and private-sector partners have worked with virtual asset service providers to interdict the stolen assets, and those collective efforts have so far resulted in the freeze of more than $2.7 billion. The genuinely new legal step is what sits inside that frozen total: the Department has already obtained court authorisation to seize or restrain in excess of $1.2 billion of that amount. The $1.2 billion is part of the $2.7 billion frozen, not additional money, and authorisation to seize is not a completed forfeiture and not money returned to anyone yet. The same announcement also disrupted a separate North Korean scheme the FBI calls FaceStealer; the Department presents the two as separate actions, and FaceStealer is covered on our AI Threats page.
Who is affected
The people affected remain Binance’s customers, and this announcement describes no new loss to them. Binance said on November 12, in a post reported by Cointelegraph, that it had covered the affected assets with its own funds and that a new proof-of-reserves snapshot showed at least one-to-one backing for customer assets — completing the coverage path this desk last reported at about 95 percent on November 1. The frozen and seizure-authorised assets are the stolen exchange funds themselves, held at the services and addresses where investigators intercepted them; the announcement names no individual customers and requires nothing of them. Tracing, freezing, seizure and forfeiture efforts are continuing, the Department says, as TraderTraitor actors keep laundering the remaining assets through cryptocurrency bridges, mixers and exchanges. In the week before the announcement, the FBI, with the US Secret Service and IRS Criminal Investigation, issued a cyber alert attributing the theft and urging service providers to block transactions from the laundering addresses.
How serious
For customers, the concrete position is better than it was on November 1 and still not closed. Coverage being complete, on Binance’s own statement, means the exchange says customer balances are whole and backed at least one-to-one; the seizure authorisation means more than $1.2 billion of the stolen pool is now under a court’s control rather than merely frozen at a provider’s discretion, which is the step that has to happen before any forfeiture or return process can exist. What has not happened is just as specific: no forfeiture has been completed, no return timetable has been announced, and the difference between the frozen $2.7 billion and the $6 billion-plus stolen is still being laundered in the open. The live risk for individual customers is the one this theft has carried from the start — messages posing as Binance, the FBI or a “seizure claims” service, offering to release or refund funds in exchange for a wallet connection, a seed phrase or an upfront fee. No part of this announcement creates a claims process of that kind.
What to do now
There is nothing to file, claim or sign under this announcement. Check your balance and the proof-of-reserves position inside Binance’s official app or website, reached by typing the address yourself, and leave it there. Treat any message about frozen funds, seizure refunds or recovery claims — however official it looks, and even if it quotes the real $1.2 billion and $2.7 billion figures from this announcement — as a scam attempt: no genuine recovery step will ever ask for your seed phrase, your password or a payment to release money. The FBI’s recovery work is coordinated by its Los Angeles Field Office, Cyber Division and Virtual Asset Unit with the Secret Service and IRS-CI, and any future forfeiture or return step will be announced by the Justice Department, not by a message to your inbox. If the forfeiture position or a return process changes, this report will be updated.
Sources: US Department of Justice, “Justice Department announces actions to disrupt North Korea’s massive theft of cryptocurrency,” November 12, 2026 · Cointelegraph, “DOJ targets $1.2B from Binance hack, disrupts Facestealer,” November 13, 2026