U.S. Justice Department Gains Court Control Over $1.2 Billion in Stolen Binance Crypto

The U.S. Justice Department has secured court authorization to seize or restrain more than $1.2 billion in cryptocurrency tied to the October theft from Binance. The FBI attributes the attack to North Korea.

That is the verified core of the story, straight from the department's own filings. But the authorization comes with limits. It does not establish that the full $1.2 billion has actually been seized or returned to anyone. The department said tracing and forfeiture work is continuing, which means the legal authority now exists while the operational recovery remains unfinished business.

How the theft unfolded

The department said members of the North Korean military stole more than $6 billion in virtual assets from Binance on or about Oct. 29. The FBI calls the group behind the operation "TraderTraitor" and separately attributed the theft to North Korea, giving investigators and the public two confirming signals from the two agencies most positioned to know.

The scale matters. A $6 billion theft dwarfs most crypto exploits on record. And the response has been proportionate: more than $2.7 billion in stolen assets has been frozen through combined U.S. government and private-sector efforts. The $1.2 billion covered by the new court authorization sits inside that larger frozen total.

What has actually been recovered?

Here is where the story requires care. Several things are true at once, and they do not add up to a completed recovery:

• Court authorization covers $1.2 billion in assets tied to the Oct. 29 theft.
• More than $2.7 billion is frozen across government and private-sector efforts combined.
• The group stole more than $6 billion, per the Justice Department's account.
• No sale or completed return of the authorized assets has been reported.

So the gap between what courts control and what victims might see back remains wide. Freezing an asset on-chain is one thing. Converting a restraint order into a forfeiture, and then a distribution, is a longer legal road. The department has not disclosed a timeline for that process.

What does this change for the industry?

The practical question for exchanges and institutional players is straightforward. This action shows the U.S. government can move fast enough after a major exploit to lock down a meaningful share of stolen funds — but it also shows the ceiling on that speed. Roughly $2.7 billion frozen out of a theft north of $6 billion means the attackers laundered or moved beyond reach a substantial portion before interdiction caught up.

The FBI's Oct. 31 alert added a technical detail that matters for anyone tracing these funds. The bureau said it observed the stolen assets being converted primarily into Ether (ETH). That conversion pattern shapes the entire recovery effort, because Ethereum's transparent ledger is precisely what makes freezing work possible at this scale. Chain choice, in effect, determined how much of the haul could ever be restrained.

The department did not disclose a token-by-token breakdown for the $1.2 billion under the court order. That leaves open questions about the current composition of the restrained assets — how much sits in ETH, how much in other tokens or wrapped instruments, and how much has already been frozen versus merely covered by the authorization's legal reach.

Why the attribution matters

The North Korea attribution is not a footnote. It changes the legal and operational posture of the entire case. State-linked actors convert a criminal matter into a national-security one, which typically unlocks broader interagency coordination — FBI, Justice Department, Treasury — and cooperation channels with private-sector firms that control the exchange chokepoints where stolen funds try to exit.

The combined $2.7 billion freeze already reflects that public-private machinery at work. Private firms cannot forfeit assets, but they can freeze them at the exchange level while court processes catch up. That division of labor appears to be exactly what happened here.

What comes next

The department's language points forward without promising a date. Tracing and forfeiture work continues. The next concrete milestones to watch are a forfeiture judgment converting restraint into government custody, and any subsequent victim-restitution process for Binance. Until a sale or completed return is reported, the $1.2 billion remains authorized on paper but not yet delivered into anyone's hands.