EL7.AI
CryptoMedium•13 November 2026•
4 min read

U.S. Justice Department Obtains Court Authorization Over More Than $1.2 Billion in Stolen Binance Assets

Key Facts

1On November 12, the U.S. Justice Department obtained court authorization to seize or restrict more than $1.2 billion in cryptocurrency stolen from Binance.
2Assets linked to the theft and frozen through government and private-sector efforts exceeded $2.7 billion, including more than $1.2 billion covered by court authorization.
3The theft occurred around October 29, and the Justice Department attributed it to members of the North Korean military known as TraderTraitor.
4The Justice Department said the separate FaceStealer scheme caused the theft of more than $400 million during the preceding eighteen months, and the FBI seized more than 900 webcam videos of its victims.

The U.S. Justice Department said on November 12 that it had obtained court authorization to seize or restrict more than $1.2 billion in cryptocurrency stolen from Binance. The action is part of government and private-sector efforts to trace and freeze funds linked to the attack, with part of the legal process still before the relevant authorities. The department said the amount covered by the authorization represents a portion of assets already frozen, not final seizure proceeds returned to their owners. The move puts the focus on recovering the funds and identifying their legitimate claimants. The department had attributed the theft to members of the North Korean military.

According to the Justice Department, the value of assets linked to the theft that had been frozen through joint U.S. government and private-sector efforts exceeded $2.7 billion as of its announcement. Of that total, court authorization was issued for more than $1.2 billion, for seizure or restriction. The distinction is between freezing assets, which limits the ability to transfer them, and completing forfeiture proceedings. The department said the efforts include tracing, freezing, seizing and finally forfeiting assets, and remain ongoing. It did not announce that all frozen funds had become government property or been returned to those affected.

The department said the theft occurred around October 29 and attributed it to members of the North Korean military whom the Federal Bureau of Investigation calls TraderTraitor. It said the group stole virtual assets worth more than $6 billion. That figure remains an estimate of the value of the stolen assets, while the $2.7 billion and $1.2 billion figures refer to frozen funds and the court authorization, respectively. In a separate statement on the attack, the FBI, the Internal Revenue Service and the U.S. Secret Service urged virtual-asset service providers and decentralized finance service operators to block transactions linked to addresses used by the attackers. The department did not specify the number of those addresses in its announcement.

The department warned that the actors blamed for the attack continue to launder assets through cryptocurrency bridges, mixers and trading platforms. It said efforts to trace, freeze, seize and finally forfeit the funds remain underway, indicating that the court authorization does not conclude the process. These channels allow assets to move between different services and networks, while disrupting transactions linked to the relevant addresses remains part of the efforts by authorities and the private sector. The department said work on the stolen assets is ongoing, without specifying a timetable for completing recovery proceedings. Its statement did not identify the use of any particular currency in the laundering.

According to The Associated Press, the U.S. government typically files a forfeiture claim with a judge, who then determines the legitimate claimants to the recovered funds. This means authorization to seize or restrict assets is one step in a broader legal process, not a final ruling on who will receive them. Determining the rights holders depends on the court’s consideration of claims. The report did not give a date for filing the claim in this case or for a decision. The distribution of recovered funds therefore remains subject to subsequent court proceedings.

In a separate announcement issued the same day, the Justice Department said another scheme known as FaceStealer and attributed to North Korea had caused the theft of more than $400 million in cryptocurrency during the preceding eighteen months. It added that the FBI had seized, under a federal warrant, more than 900 webcam videos of victims of the scheme. The announcement coincided with the actions involving Binance assets, but concerned a separate scheme. The two cases were presented in the statement as efforts to counter theft and laundering of assets attributed by authorities to North Korean actors. The department did not link FaceStealer funds to the frozen assets in the Binance case.