Court Order Targets $1.2 billion of Binance Hack Funds as Coverage Is Completed

By Coinvote

Published November 14, 2026 - 07:21 UTC | 5 mins read

Court Order Targets $1.2 billion of Binance Hack Funds as Coverage Is Completed

The US Justice Department says a court has approved seizing or restraining over $1.2 billion of the crypto stolen from Binance on Oct. 29. Binance says it has covered customer losses from its own funds, but its proof of reserves is not yet verifiable by users.

Justice Department moves on a slice of the stolen funds

Cointelegraph reported that the Justice Department said Thursday a court had approved seizing or restraining over $1.2 billion of the roughly $6.3 billion in cryptocurrency taken from Binance. That sum is a portion of the $2.7 billion-plus that US officials and private partners have frozen since the Oct. 29 theft. The department said efforts to recover more of the money are continuing.

The Block listed the action in its newsletter alongside a separate DOJ move against a North Korean deepfake scheme, but its summary gives no further detail. Protos reported that the US believes the freezes allowed authorities to act before the money "got beyond law enforcement reach." According to Cointelegraph, a cyber alert from the FBI pinned the Binance theft on TraderTraitor, a North Korean group.

Who froze the money and how it moved

Protos named the firms behind the $2.7 billion in freezes as Tether, Ripple, Circle, World Liberty Financial and Arbitrum. A freeze stops a token issuer or intermediary from letting the funds move. A seizure order is a separate legal step that lets the government take custody. That distinction explains why the $1.2 billion is described as a portion of the larger frozen total.

The DOJ report also described how hackers launder stolen funds through crypto bridges, mixers and exchanges, according to Protos. It noted an earlier cyber alert urging node operators linked to THORChain to block transactions tied to TraderTraitor. Protos added that the DOJ did not mention one laundering route, the use of cheap memecoins.

The numbers in the case

The outlets report several figures that are easy to confuse. They measure different things: the theft, the frozen assets, the court authorization and a separate scam.

More than $1.2 billion: the amount the DOJ has authorization to seize or restrain, per Cointelegraph.
$6.3 billion and $6.34 billion: the size of the theft, as rounded by Cointelegraph and as stated by Bitcoin Magazine.
More than $2.7 billion: assets frozen by authorities and private partners since Oct. 29.
More than $400 million: stolen in 18 months by the separate FaceStealer campaign, per the DOJ.
More than 900: webcam videos of FaceStealer victims seized by the FBI under a federal warrant.
198 tokens: the scope of Binance's new proof-of-reserves snapshot, up from 10 tokens in the Oct. 31 version.

FaceStealer relied on deepfaked video calls

According to Cointelegraph, the DOJ said the FaceStealer hackers won trust on video calls by using covertly recorded clips of past targets along with AI-made fakes of well-known crypto personalities. Targets were then pushed to install malware disguised as a technical fix. The campaign went after people working in crypto and Web3, and the hackers increasingly sought out open-source maintainers and developers to reach their machines and code-repository logins.

US authorities seized cloud infrastructure used in the campaign, and the FBI published a public advisory on protection and post-compromise steps. The DOJ listed several names for the group, including Sapphire Sleet, UNC1069, BlueNoroff and APT38. Protos suggested that similar techniques may have been used when fake job interviews delivered malware to Binance employees. Bitcoin Magazine reported that, per Binance's Nov. 3 incident report, the breach started with a bogus job interview and a tampered developer tool.

Binance says users are whole, but the proof is pending

Binance said Thursday it had completed coverage of the affected assets using company funds, Bitcoin Magazine reported. The exchange said it drew on a partial deployment of its SAFU reserve, part of its futures insurance fund and its corporate treasury. It also committed to replenishing SAFU to about $1 billion. Coverage means Binance replaced the tokens from its own books, not that the stolen coins came back.

The 198-token snapshot was taken at 00:00 UTC on Nov. 12. Binance said generating the complete zero-knowledge proof will take roughly 40 to 50 hours. Until it is published, the one-to-one backing is Binance's own statement, as Bitcoin Magazine noted. Withdrawals first reopened on Nov. 1 and are still returning in phases.

Where the accounts differ

The outlets use different verbs for the US action. Protos wrote that the DOJ announced a seizure of $1.2 billion, while Cointelegraph described authorization to seize or restrain that amount, which is a looser claim. Protos dated the announcement to the day before its Nov. 13 article, while Cointelegraph said Thursday. Bitcoin Magazine did not cover the DOJ action and focused on Binance's coverage.

Only Protos carried North Korea's response. It reported that the country denied involvement, and that Kim Yo Jong called the allegations "a grave political provocation against the DPRK." Cointelegraph also noted the denial. Cointelegraph added that the DOJ announced a separate action over about $15 million linked to APT38 in November 2025, which puts the new order in a longer enforcement record.

Open questions to watch

The first question is how much of the $1.2 billion will end up permanently seized rather than restrained. The sources do not say what happens to the money after seizure. Binance's announcement also gave no figure for how much of the stolen amount has been retrieved.

The second is whether the zero-knowledge proof, due in roughly two days according to Bitcoin Magazine, confirms the new snapshot. Users holding the affected tokens will then be able to check the backing themselves. Developers and crypto staff can also review the FBI advisory, since the DOJ says FaceStealer targets exactly that group through fake video-call fixes.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$67,271	-2.6%	-11.3%	$1.35 trillion
Ethereum (ETH)	$1,897	-2.3%	-15.2%	$231.88 billion
XRP (XRP)	$0.986433	-4.1%	-14.4%	$62.65 billion
World Liberty Financial (WLFI)	$0.04730681	+0.0%	+3.0%	$1.50 billion

CoinGecko data as of 2026-11-14 (UTC).

FAQ

How much of the Binance hack has the US moved to seize?

According to Cointelegraph, the DOJ said a court has approved seizing or restraining over $1.2 billion. That is part of more than $2.7 billion frozen since the Oct. 29 hack. The theft totalled about $6.3 billion in that outlet's account.

Has Binance recovered the stolen funds?

No recovery figure has been given. Binance said it covered affected assets with its own funds, including SAFU and its treasury, as Bitcoin Magazine reported. That replaces customer tokens but does not return the stolen coins.

What is the FaceStealer scam?

FaceStealer is a North Korean social engineering campaign that the DOJ says stole more than $400 million over 18 months. Hackers used recorded footage and AI deepfakes on video calls, then pushed victims to install malware disguised as a fix, according to Cointelegraph.