DOJ Freezes or Preserves $2.7 Billion Tied to Binance Theft

The U.S. Department of Justice says it has frozen or preserved roughly $2.7 billion in funds connected to stolen Binance assets, an amount approaching half of the more than $6 billion in reported losses from the incident.

The DOJ carried out the action with the cooperation of two stablecoin issuers, whose involvement gave the department a practical choke point: stablecoin issuers can blacklist addresses and halt redemption, making them among the few actors in crypto able to immobilize value quickly once stolen funds convert into their tokens.

What exactly does the $2.7 billion cover?

The figure describes funds under restriction, not restitution. The DOJ's reported total covers assets that were frozen or preserved, and it does not describe a completed payout to victims. Recovered or frozen funds in crypto cases typically move to a forfeiture process before any distribution, which can take months or years depending on litigation.

One gap in the disclosure: the reported figure does not separate the amount frozen from the amount preserved. The distinction matters operationally — frozen funds sit under formal restraint, while preserved funds may be held at the request of investigators without a completed freeze order. Either way, roughly $2.7 billion of the more than $6 billion stolen now sits under some form of U.S. government control or protection.

That leaves the arithmetic stark. Against reported losses topping $6 billion, the action covers just under half, meaning more than $3 billion in stolen assets remains unaccounted for in this disclosure.

Why stablecoin issuers were the enforcement lever

Stablecoins have become the default settlement rail for illicit crypto flows precisely because of their liquidity, and that same design makes them the point where law enforcement can intervene. Major issuers operate centralized blacklist functions and comply with U.S. legal process, so once stolen funds pass through their contracts, the DOJ can act without needing to trace value across multiple intermediary chains.

The DOJ did not name the two issuers in the disclosure. The reliance on two of them, however, signals that the stolen funds were converted into a small number of dollar-pegged tokens before the intervention landed.

FBI warns of FaceStealer and supply-chain attacks

In a separate advisory, the FBI's cyber division warned that North Korean hackers are deploying a social-engineering technique it identified as FaceStealer to steal crypto assets. The warning described two delivery methods:

• Impersonation through fake video-conferencing platforms, luring targets into malicious sessions
• Attacks on software supply chains, compromising trusted development or distribution channels

The advisory sits alongside the DOJ recovery as a single picture of the current threat environment: state-linked groups pursue theft at scale, and the cleanup now runs through stablecoin issuers and federal prosecutors rather than exchange security teams alone.

What happens next

The immediate open question is victim compensation — a payout process has not been announced, and forfeiture proceedings will determine when, or whether, the $2.7 billion reaches account holders. Expect further seizure actions as investigators trace the remaining stolen funds still in circulation.