US authorities have obtained court authorization to recover part of the assets stolen from Binance. The exchange says it has replaced the losses with its own funds and reopened withdrawals on 87 networks.
The US Department of Justice has obtained court authorization to seize or restrain more than $1.2 billion in assets stolen from crypto exchange Binance. In its November 12 announcement, the department said authorities had worked with exchanges and other virtual asset service providers to freeze over $2.7 billion in total.
The court authorization covers part of that $2.7 billion; it does not add another $1.2 billion to the frozen total. Investigators are still tracing the stolen funds and trying to freeze and recover more of them. The announcement gives no date for returning assets to customers and reports no completed customer repayment.
The $1.2 billion is part of the frozen total
The department did not give separate totals for assets taken into government control and assets placed under transfer restrictions. It also did not publish the full orders, case numbers or a final allocation of the assets. M. Scott Proctor of the National Security Division said the aim was to seize the stolen funds and return them to victims.
In an October 31 alert, the FBI attributed the Binance theft of more than $6 billion, which occurred on or about October 29, to North Korea-linked TraderTraitor actors. The bureau said the stolen assets were being converted primarily into Ether and other cryptocurrencies. The Justice Department said the attackers were laundering funds through cross-chain bridges, mixers and exchanges.
The FBI asked service providers to block transactions with, or derived from, the listed wallet addresses. Its appeal included THORChain node operators and RPC services that handle applications’ requests to a blockchain, instant exchanges, DeFi platforms, blockchain analytics firms and other providers. The addresses hold or have held stolen assets; the list alone does not establish their current balances.
North Korea denies responsibility. According to Yonhap’s November 3 report, Kim Yo-jong called the FBI’s attribution of the Binance attack a political provocation in a statement carried by KCNA.
| Amount | Source and scope |
|---|---|
| More than $2.7 billion | Total assets the Justice Department reported frozen on November 12. |
| More than $1.2 billion | Part of that total covered by court authorization to seize or restrain. |
| More than $6.34 billion | Company resources Binance says it used to replace the stolen assets. |
How Binance says it covered the losses
In a statement signed November 13, Binance said it had finished replacing the affected assets using more than $6.34 billion of its own resources. It said it had sourced the tokens through market and over-the-counter purchases. Those company-funded purchases are separate from any distribution of the assets frozen by investigators.
Binance said the money came from part of its SAFU security fund, the portion of its futures insurance fund above required risk-management levels, and corporate treasury assets. It pledged to restore SAFU to approximately $1 billion; it did not say it had finished putting that money back.
The exchange also announced a proof-of-reserves snapshot covering 198 tokens as of 00:00 UTC on November 12. It estimated that generating the full zero-knowledge proof would take 40–50 hours, after which holders of affected tokens would be able to verify at least one-to-one backing. The timing was an estimate. The snapshot records balances at one point in time; it does not establish that withdrawals are open on every network.
Binance’s November 14 service update says withdrawals reopened on 87 networks during the week, including Litecoin, NEAR, Stellar, Cardano, Cosmos and Avalanche. The exchange aims to restore withdrawals for all remaining networks and assets by the end of next week. It directs customers to check availability for their particular asset and network on the withdrawal screen or network status page, and warns that traffic may cause delays or longer processing times.
FaceStealer is a separate operation
The Justice Department announced the Binance recovery actions alongside a separate cryptocurrency theft operation known as FaceStealer. Authorities seized cloud infrastructure used by the attackers in that case. The department put FaceStealer thefts at more than $400 million over 18 months.
The FBI says the attackers use hijacked Telegram or LinkedIn accounts to impersonate a familiar contact and invite targets to fake Zoom or Microsoft Teams meetings. They build trust with webcam recordings of earlier victims, then induce the target to download malware under the pretext of fixing an audio problem or installing an update. This phishing targets crypto and Web3 workers as well as open-source software developers.
Authorities said the seized infrastructure contained more than 900 webcam recordings, which the attackers could reuse to impersonate victims in later meetings. The Justice Department did not say that FaceStealer’s method was also used to breach Binance.
In the FBI’s FaceStealer video, the section beginning at 0:35 explains the steps from a fake invitation to a malware download. Published on November 13, the recording features Jeremy Robertson, who oversees cyber and counterintelligence work at the FBI’s Los Angeles field office.
