Binance Hack Seizure: DOJ Gets Court Orders for $1.2B of Stolen Crypto

The US Department of Justice said on 12 November 2026 that it has court authorization to seize or restrain more than $1.2 billion of the crypto stolen from Binance on 29 October. It is the first court action DOJ has disclosed to claw back funds from the largest crypto theft on record, which the FBI attributes to North Korea's TraderTraitor unit (DOJ release).

The same release says US government and private-sector efforts have frozen more than $2.7 billion of the more than $6 billion taken. Measured against TRM Labs' on-chain count of about $6.36 billion stolen, the court-authorized amount is about 19% of the haul and about 44% of what has been frozen. On the same day, Binance said it had finished replacing all affected customer assets with its own money (Bitcoin Magazine).

Key Takeaways

• DOJ has court authorization to seize or restrain more than $1.2 billion of the stolen Binance assets, out of more than $2.7 billion frozen so far.
• That leaves roughly $1.5 billion frozen but not yet covered by a disclosed court order, and about $3.7 billion of the $6.36 billion taken neither frozen nor seized.
• DOJ did not say which tokens, wallets or court the $1.2 billion covers. Tether and Circle have separately claimed freezes of more than $1.5 billion and about $1.1 billion.
• Binance says customers are fully covered from its own funds, so any forfeited assets would in practice offset Binance's loss rather than reach users directly.
• Forfeiture is slow: DOJ's own guidance says it cannot give a timeline for returning forfeited assets to victims.

What did the DOJ announce on 12 November 2026?

The DOJ announced on 12 November 2026 two actions against North Korean crypto theft: a court-authorized seizure and restraint of more than $1.2 billion stolen from Binance, and the takedown of cloud infrastructure behind a separate deepfake video-call scheme the FBI calls FaceStealer, which it links to more than $400 million in thefts over 18 months (DOJ release).

On Binance, the release credits the National Security Division, the Criminal Division's Computer Crime and Intellectual Property Section and the US Attorney's Office for the District of Columbia, working with virtual asset service providers. Assistant Attorney General A. Tysen Duva said the Criminal Division helped "immediately halt about half of this historic breach." The department says efforts to "trace, freeze, seize, and forfeit" the rest are ongoing as TraderTraitor launders funds through bridges, mixers and exchanges.

The wording matters. DOJ says "seize or restrain," not "seized." A restraint order keeps assets in place while forfeiture proceeds; a seizure moves them into government control. Some headlines, including The Record's, report a $1.2 billion seizure, but the release does not split the amount between the two or name the court or the assets involved.

How much of the stolen $6.36 billion has been frozen or seized?

About 42% of the stolen $6.36 billion has been frozen and about 19% is under the court authorization DOJ disclosed, using TRM Labs' theft total and DOJ's 12 November figures. Both DOJ numbers are "more than" floors, so the true shares may be slightly higher.

Our arithmetic from those figures:

• $1.2B ÷ $6.36B ≈ 19% of the theft is under disclosed court authorization.
• $1.2B ÷ $2.7B ≈ 44% of the frozen pool has moved from a freeze to a court order.
• $2.7B − $1.2B ≈ $1.5B is frozen but not yet covered by a disclosed order.
• $6.36B − $2.7B ≈ $3.7B is neither frozen nor seized. TRM put the part beyond any issuer's reach at about $2.4 billion in ETH and BTC on 30 October; conversions since then mean that mix has changed.

Why do the frozen totals differ?

The frozen totals differ because each source counts a different set of assets at a different time. The table lists the published figures; each row links to its source.

Two patterns stand out. First, DOJ's figure sits at the low end of the range, and the release does not explain how it was counted. Second, issuer claims and on-chain counts don't line up: Tether says it froze more than $1.5 billion in USDT within 30 minutes (Tether) while TRM counted about 1.77 billion USDT frozen by 00:30 UTC, and Circle says it froze about $1.1 billion in USDC (Circle) against TRM's early count of about 825 million. Bloomberg Law reports that the $2.7 billion was frozen by Tether and Circle; DOJ's release itself names no issuer.

Who gets the money if it is forfeited?

The money would go to the victims only after a court finalizes forfeiture and DOJ approves a claim, and here the main claimant is likely to be Binance itself. Binance said on 12 November that it had completed coverage of affected assets using more than $6.34 billion of company funds, drawn from its SAFU fund, part of its futures insurance fund and its corporate treasury (Bitcoin Magazine; crypto.news).

Under DOJ's remission rules, a victim must show a specific pecuniary loss and must "not in fact" have been compensated for it (28 CFR 9.8). Customers whose balances Binance replaced would struggle to meet that test; Binance, which absorbed the loss, is the obvious candidate. DOJ also warns that remission is discretionary, that net proceeds are shared pro rata, and that it "cannot provide a timeline" (DOJ forfeiture FAQ). This is our reading of the general rules; DOJ has not said how it will handle this case.

Stolen stablecoins have a shortcut that BTC and ETH lack. As we explained in our Binance hack breakdown, an issuer can burn frozen USDT or USDC and reissue it once there is a court order or seizure warrant. Circle says it does not decide ownership or forfeiture; it acts on valid legal process (Circle).

How did the case get from theft to court order?

The case went from theft to a disclosed court order in 14 days; DOJ did not say when the court granted it. The table shows the public milestones; each row links to its source.

When we looked at the case on 2 November, we found no public seizure action (our issuer-control analysis). The 12 November release closes that gap for about $1.2 billion.

Our take

💬Our take: The headline number is the $1.2 billion, but the more useful one is the $1.5 billion still sitting between a freeze and a court order. A freeze is an issuer decision. Recovery needs a judge. Until DOJ files forfeiture papers that name assets and wallets, nobody outside the case can say how much of the frozen USDT and USDC will end up burned and reissued, or to whom. The case also strengthens the argument for freezable stablecoins: almost all of what has been stopped so far is issuer-controlled tokens, while the BTC and ETH are still moving through laundering routes.

For treasury and compliance teams, the practical lesson is to know which assets you hold can be frozen, by whom, and under what process. Our guide to stablecoin freezes covers the mechanics, and you can check a single address with our USDT blacklist checker guide.

Weighing freeze powers under US law? See how the GENIUS Act requires issuers to be able to comply with lawful orders.

For the full picture, see our Stablecoin regulation hub.

FAQ

Did the US government seize $1.2 billion from Binance?

No, the US government did not seize $1.2 billion from Binance. It obtained court authorization to seize or restrain more than $1.2 billion of crypto stolen from Binance by North Korean hackers (DOJ release). Binance is the victim, not the target.

Is the $1.2 billion the same as Tether's 1.2 billion USDT returned?

No, the $1.2 billion is not the same as Tether's figure. Tether says about 1.2 billion USDT has been returned through reissuance across all its past fraud and theft cases, as of its 2 November statement (Tether). The DOJ figure refers only to the Binance theft.

Will Binance customers get anything back from the seizure?

Binance customers are unlikely to get anything directly from the seizure, because Binance says it has already covered all affected assets with company funds (Bitcoin Magazine). DOJ remission rules exclude losses that have already been compensated (28 CFR 9.8).

Can I verify that Binance has replaced my assets?

You can verify that Binance has replaced your assets only once its new zero-knowledge proof is published. Binance said the proof for its 12 November reserve snapshot of 198 tokens would take about 40 to 50 hours to generate (Bitcoin Magazine).

What happens next?

Next, watch for forfeiture filings. A civil or criminal forfeiture complaint would be the first document to list which wallets and tokens the $1.2 billion covers and which court is handling it. Watch too for orders covering the remaining roughly $1.5 billion that is frozen, for further FBI address updates as the ETH and BTC move, and for Binance's zero-knowledge proof, which will show whether its "100%" coverage claim holds up (DOJ; Bitcoin Magazine).

Sources: US Department of Justice release (12 Nov 2026); TRM Labs, Binance hack analysis (29–30 Oct 2026); SecurityWeek on the FBI alert (2 Nov 2026); Bitcoin Magazine on Binance coverage (12 Nov 2026); crypto.news (12 Nov 2026); Tether statement (2 Nov 2026); Circle blog (5 Nov 2026); Bloomberg Law (12 Nov 2026); The Record (12 Nov 2026); Unchained (13 Nov 2026); BeInCrypto (12 Nov 2026); DOJ FAQ on compensating victims with forfeited assets; 28 CFR 9.8. All read on 13 November 2026.

---

This content is provided for informational and educational purposes only and doesn't constitute financial, investment, legal or tax advice. Figures were read on 13 November 2026 and may change as the investigation continues; percentages are we calculations from published figures. Our reading of the forfeiture rules is general and not a statement of how DOJ will handle this case. It isn't a recommendation to buy, sell or hold BTC, ETH, USDT, USDC or any other asset, or to use Binance, Tether, Circle or any other company named.

Join the official Coincamps community:

X: https://x.com/coincamps

Telegram: https://t.me/coin_camps