WYDE
    Crypto and markets

    Binance Stolen Crypto Recovery: DOJ Obtains Court Order to Seize or Restrain More Than $1.2 Billion

    The U.S. Justice Department said Thursday, Nov. 12 it obtained court authorization to seize or restrain more than $1.2 billion in crypto stolen from Binance, a step the department tied to North Korea.

    By ·WYDE Newsroom· 4 min read
    Share
    Binance Stolen Crypto Recovery: DOJ Obtains Court Order to Seize or Restrain More Than $1.2 Billion

    Photo: ajay_suresh / Wikimedia Commons, CC BY 2.0

    Key Takeaways

    • Binance stolen crypto recovery: the U.S. Justice Department (DOJ) said Thursday, Nov. 12 it obtained court authorization to seize or restrain more than $1.2 billion in crypto stolen from Binance.
    • Binance stolen crypto frozen: government and private-sector efforts have frozen (blocked from being moved) more than $2.7 billion of the more than $6 billion stolen on or about Oct. 29.
    • Binance theft attribution: the department attributed the theft to actors linked to the North Korean military.
    • FaceStealer disruption: the department disrupted cloud-based infrastructure tied to a social-engineering campaign that it says has stolen more than $400 million over 18 months.

    The U.S. Justice Department (DOJ) said Thursday, Nov. 12 it obtained court authorization to seize or restrain more than $1.2 billion in stolen Binance crypto, a recovery step that the department tied to North Korea. The theft of more than $6 billion from Binance took place on or about Oct. 29, the department said.

    Binance stolen crypto: the $1.2 billion court authorization against the $2.7 billion frozen

    The department said the $1.2 billion covered by the court authorization is part of the more than $2.7 billion frozen, and the frozen total is part of the more than $6 billion stolen. On the reported figures, the court authorization covers about 44% of the frozen total ($1.2 billion divided by $2.7 billion). The court authorization alone is about 20% of the amount stolen ($1.2 billion divided by $6 billion). The frozen total is about 45% of it ($2.7 billion divided by $6 billion).

    All three figures are floors (more than), so each share is a rounded WYDE estimate, and the true share could be higher or lower. Neither CNBC nor Quartz reports these shares as the department's figures. Assistant Attorney General A. Tysen Duva of the Criminal Division said the division and its law enforcement partners froze about half of the stolen assets before the funds moved out of reach (Quartz). That figure covers only the division and its law enforcement partners, while the $2.7 billion counts government and private-sector efforts together, so the 45% and the about-half figure measure different things. The totals come from the department's announcement, as CNBC and Quartz report it, and WYDE has not checked them against court filings.

    DOJ court authorization: what it covers in the Binance case

    The court authorization covers more than $1.2 billion in cryptocurrency stolen from Binance. To seize means to take control of property, and to restrain means to block it from being moved. The department said its coordinated action includes the court-authorized seizure and restraint of those funds. That action is aimed at what it called North Korea's schemes to fund its regime through the massive theft of cryptocurrency.

    CNBC's report says U.S. authorities have seized around $1.2 billion. The department's own term is a court authorization to seize or restrain more than $1.2 billion, and Quartz calls the same step a court order. M. Scott Proctor, Principal Deputy Assistant Attorney General for National Security, said in a statement: "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft." The statement added: "The National Security Division will use every tool at its disposal to seize and return North Korea's ill-gotten gains."

    CNBC's report says collective efforts between the U.S. government and private sector have frozen more than $2.7 billion of the more than $6 billion stolen.

    FaceStealer, the separate scheme the department disrupted

    The department also disrupted cloud-based infrastructure used in FaceStealer, which it describes as a social-engineering campaign that has stolen more than $400 million over 18 months. Social engineering means tricking people into giving up access or money. The department said FaceStealer uses recorded videos and deepfakes, which are AI-made fake videos, to lure targets into fake video meetings and install malware.

    CNBC's report adds that the department vowed action to tackle cyberscams originating from North Korea. Quartz reports the FBI calls FaceStealer a North Korean scheme. Quartz reports that the FaceStealer disruption was announced alongside the Binance court authorization.

    People Also Ask

    What did the Justice Department obtain in the Binance stolen crypto case?

    The Justice Department obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, the department said Thursday, Nov. 12. The $1.2 billion covered by that authorization is part of the more than $2.7 billion that government and private-sector efforts have frozen. The theft of more than $6 billion from Binance took place on or about Oct. 29.

    Who did the Justice Department link to the Binance theft?

    The Justice Department attributed the theft of more than $6 billion from Binance to actors linked to the North Korean military. The department said it was taking coordinated action against what it called North Korea's schemes to fund its regime through the massive theft of cryptocurrency.

    How much of the stolen Binance crypto is frozen?

    Government and private-sector efforts have frozen more than $2.7 billion of the more than $6 billion stolen from Binance. The department said the $1.2 billion covered by the court authorization is part of that frozen total.

    What is FaceStealer?

    FaceStealer is a social-engineering scam that the Justice Department says has stolen more than $400 million over 18 months. The department disrupted cloud-based infrastructure used in FaceStealer, and it said the scheme uses recorded videos and deepfakes to lure targets into fake video meetings and install malware.

    Sources: CNBC, Quartz.

    How this story was made: WYDE’s newsroom software found the sources and drafted this report under the editor’s rules. Every quotation and figure was checked against the sources cited before it was published. Our ethics policy

    crypto & defigovernment & fraud
    Share

    IN THIS STORY

    RELATED COVERAGE

    Senators Press AG Nominee Todd Blanche on Crypto Enforcement and the Binance Pardon

    Jul 16, 2026 · 2 min read

    US Prosecutors Probe Binance Over Iran Sanctions Three Years After Its $4.3 Billion Plea

    Sep 22, 2026 · 2 min read

    Binance Hack Report: Fake Job Interview and Tampered Homebrew Download Led to $6.34 Billion Theft

    Nov 4, 2026 · 4 min read

    Don't miss the next story.

    Nonprofit data, crypto markets and policy, every week.