More than $1.2 billion in cryptocurrency linked to the October 29 Binance theft is now subject to U.S. court-authorized seizure or restraint, the Justice Department said November 12. The amount is part of more than $2.7 billion already frozen—not a new recovery—and the original theft exceeded $6 billion. The order gives investigators a legal path to secure assets while the fight over their ultimate ownership remains open.
The FBI attributes the theft to North Korean military hackers it calls TraderTraitor. Investigators say the stolen tokens are still being routed through crypto bridges, mixers and exchanges, so tracing and recovery efforts continue. The announcement did not say all the stolen money had been recovered: more than $2.7 billion is frozen, while over $1.2 billion of that amount is covered by court authorization. The figures describe overlapping stages, not sums to add.
That distinction matters. A freeze blocks movement; seizure or restraint under court authority secures property for legal proceedings, but does not by itself decide who owns it or guarantee a payout to victims. The government typically follows with a forfeiture claim, after which a judge weighs competing claims. Binance has said it covered the losses with company resources, but that does not mean the stolen tokens themselves have been recovered.
In a separate operation announced the same day, the FBI also seized cloud infrastructure used in FaceStealer, a social-engineering campaign officials link to more than $400 million in crypto theft over 18 months. The scheme used hijacked accounts to lure people into fake video calls, played recordings or deepfakes of familiar contacts, then pushed a bogus audio fix that installed malware. A federal warrant also yielded more than 900 webcam videos. Officials say the campaign targeted cryptocurrency workers and open-source software developers, widening the risk beyond exchange accounts.