DOJ Secures Seizure Order for $1.2 Billion Stolen from Binance

A U.S. court has authorized the U.S. Department of Justice to seize or prevent the transfer of more than $1.2 billion in cryptocurrency stolen from Binance, according to the department. The order creates a legal route to recover the assets, not confirmation that Binance has already received them.

The Federal Bureau of Investigation said on October 29, 2026, that more than $6 billion in crypto assets had been stolen from Binance and attributed the attack to the North Korea-linked TraderTraitor group. Based on the reported figures, the court-backed $1.2 billion covers roughly one-fifth of the FBI's Binance loss.

DOJ also announced the seizure of cloud infrastructure used by the North Korea-linked FaceStealer campaign, which the department said had stolen more than $400 million in crypto assets. The action reaches the systems supporting the campaign rather than only the balances attributed to it.

For practitioners, that distinction matters. Infrastructure seizures can restrict a campaign's ability to operate and preserve leads for tracing funds. The announcement does not identify the hosting providers, tools or configuration involved, so it does not establish how much of FaceStealer's activity the seizure stopped.

The enforcement figures, and what they do not settle

DOJ said U.S. authorities and private-sector participants had frozen more than $2.7 billion in assets through a joint effort, including the more than $1.2 billion covered by the court order. The broader total is more than twice the court-authorized tranche.

Those figures describe different stages of enforcement. A freeze restricts movement, while a seizure places assets under official control; neither automatically establishes final restitution to Binance. DOJ did not provide a breakdown of the remainder of the $2.7 billion, a list of frozen wallets or a recovery timetable.

The naming also sets boundaries around responsibility. TraderTraitor identifies the group the FBI blamed for the Binance theft. FaceStealer identifies the campaign whose cloud infrastructure DOJ said it seized. Both carry a North Korea link in the agencies' statements.

The announcements do not establish that FaceStealer and TraderTraitor are the same operation, nor do they describe the laundering route, the final recipients or the share of stolen assets now under U.S. control.

What does this change for Binance and crypto market participants?

For Binance, the immediate change is legal leverage over the assets covered by the order, with enforcement depending on parties holding or transferring them complying with the court's requirements. For traders and market participants, the practical line is between immobilized balances and usable liquidity: seized or frozen assets should not be treated as available capital until the legal process permits transfer or restitution.

The private-sector role in the $2.7 billion freeze also shows that recovery now depends on cooperation beyond law enforcement, including assistance from intermediaries that control access to the relevant assets. Traders should therefore distinguish confirmed, transferable recoveries from headline totals that remain subject to court enforcement and asset tracing.

Attribution narrows the investigative perimeter, but it does not quantify recoveries. The Binance loss remains a reported $6 billion, the court-backed tranche remains $1.2 billion, and the FaceStealer-linked theft remains more than $400 million until agencies release further evidence and final recovery figures.

With recovery efforts still underway and no deadline disclosed, the next enforcement checkpoint is whether authorities can execute the order against parties holding the assets and convert the wider freezes and infrastructure seizure into assets that can be returned.