More Than $2.7 Billion Frozen After Binance Hack; Court Authorizes Seizure of More Than $1.2 Billion
Key Facts
The U.S. Department of Justice said on November 12 that it had obtained court authorization to seize or restrict more than $1.2 billion in cryptocurrency stolen from Binance. The amount represents part of the more than $2.7 billion frozen through cooperation between the U.S. government and private-sector companies. The Record reported that the department said several cryptocurrency platforms had frozen funds linked to the theft. The court authorization means this portion of the assets has entered the seizure or restriction process, while the broader total includes funds frozen through government and private efforts. The department said efforts to trace, freeze, seize and forfeit the proceeds remain ongoing.
The Federal Bureau of Investigation attributed the Binance theft to North Korea and dubbed the activity TraderTraitor. The bureau said the theft occurred on or about October 29, 2026, and involved more than $6 billion in virtual assets. It said it had tracked the hackers' transfer of the stolen assets primarily into Ether. It added that the assets could later be laundered through decentralized finance services and spot exchanges. The Justice Department said the group continued to launder assets through cryptocurrency bridges, mixing services and platforms.
In a separate announcement, authorities said the FaceStealer campaign stole more than $400 million in cryptocurrency during the previous 18 months. The FBI obtained a warrant to seize more than 900 webcam recordings of victims of the campaign. The operators used malicious links to Zoom or Teams meetings, recordings of previous victims, and, in some cases, AI-generated fake videos. The videos were used to lure targets into downloading malware. The campaign targeted workers in the cryptocurrency and Web3 industries, as well as open-source software developers.
FaceStealer is distinct from the Binance hack, which the FBI attributed to TraderTraitor; the announcement described the two operations as separate. The Record quoted a federal agent as saying it was unclear whether FaceStealer had been used to hack Binance. Authorities' announcement links the campaign to thefts carried out over 18 months, while the bureau dated the Binance hack to on or about October 29. The FaceStealer campaign involved impersonation and digital luring tactics, including previous recordings and, in some cases, AI-generated fake videos. Authorities said efforts to pursue the funds stolen from Binance were continuing alongside laundering through bridges, mixing services and platforms.
In an update dated November 3, Binance said 98% of affected assets had been reimbursed by October 31, and that verification was available through its proof-of-reserves page. The platform said five hot wallets sent 233.46 million XRP to an address controlled by the attacker within four minutes on October 29. It said the attacker exploited unauthorized access to an internal wallet signing service to execute transactions outside the usual withdrawal process. On October 30, Binance announced it had allocated more than $6.34 billion in company funds to cover losses, including $5 billion of the affected assets themselves. In its initial statement, it said it had temporarily suspended withdrawals to conduct security reviews and verify the integrity of affected systems, while deposits and unaffected services continued.
Market prices had reacted to news of the hack on October 29, with The Associated Press reporting that Bitcoin fell 3.2% that evening to below $79,000. The move came during the session in which the incident was announced, before the U.S. Justice Department's November 12 announcement of the freeze and court authorization. The department said efforts to trace, freeze and seize the proceeds were ongoing. It noted that laundering of the assets through cryptocurrency bridges, mixing services and platforms continued. Recovery efforts remain tied to the outcome of the ongoing tracing, freezing and seizure proceedings.