Binance Hack: US Approves US$1.2 Billion in Crypto Seizure

The Binance hack case has returned to the spotlight after the U.S. Department of Justice (DOJ) obtained court authorization to seize or restrict more than US$1.2 billion in cryptocurrency linked to the breach. Announced on November 12, 2026, the development marks a significant step in the investigation into cryptocurrency theft attributed to TraderTraitor, a North Korean hacking group.

The October 29, 2026, attack on Binance is estimated to have caused losses of approximately US$6.3 billion. As of the latest announcement, more than US$2.7 billion in stolen funds had been frozen through cooperation between U.S. authorities and cryptocurrency companies. Although some assets have been secured, returning them to their rightful owners remains unfinished and depends on further legal proceedings.

Key Takeaways

• The DOJ received court authorization to seize or restrict more than US$1.2 billion in cryptocurrency stolen in the Binance hack.
• More than US$2.7 billion in stolen assets has been frozen, including the funds covered by the court authorization.
• The FBI linked the attack to TraderTraitor, a North Korean hacking group suspected of involvement in large-scale cryptocurrency theft.

U.S. Obtains Authorization to Seize Cryptocurrency from Binance Hack

Nearly two weeks after the Binance hack, the U.S. government announced progress in its efforts to secure the stolen assets.

The DOJ stated that a court had authorized action involving more than US$1.2 billion in cryptocurrency identified during the investigation.

The measure allows law enforcement to take control of the relevant assets or impose legal restrictions to prevent their transfer.

Several agencies took part in the operation, including the FBI, the U.S. Secret Service, and the Internal Revenue Service Criminal Investigation division (IRS-CI). Cryptocurrency exchanges, digital asset issuers, and blockchain analytics providers also helped trace the funds.

That cooperation is particularly important because the stolen cryptocurrency is no longer held in a single wallet. The attackers have moved some of the assets through multiple addresses and trading services.

However, obtaining seizure authorization does not mean all the money has been returned to Binance or its users. U.S. authorities must still complete the legal proceedings needed to establish ownership and determine whether the assets can be returned.

Read also: Beware! OJK Shuts Down 16 Illegal Investment Entities, Including AI and Crypto Schemes

How Much Cryptocurrency Was Stolen from Binance?

The October 29, 2026, breach resulted in a large amount of cryptocurrency being withdrawn from Binance's hot wallets.

Losses are estimated at US$6.3 billion, making the incident one of the largest cryptocurrency thefts in the industry's history.

After detecting the attack, Binance and other parties began tracing the flow of funds to prevent the perpetrators from moving additional assets.

The following figures summarize developments reported through November 12, 2026.

Figures reflect investigation developments through November 12, 2026.

Importantly, the US$1.2 billion is already included in the US$2.7 billion that was frozen. These are not separate amounts that can be added together to calculate the total assets secured.

Other assets that have not yet been located or are still being moved across different networks remain under investigation.

Read also: What Is a Cyber Pandemic in Crypto? Understanding Cyberattack Risks

Timeline of the Binance Hack in October 2026

The theft happened over a short period, but efforts to track and freeze the funds continued for several weeks.

Here are the key developments in the case.

October 29, 2026: Binance Suffers a Hack

Unauthorized withdrawals were detected in Binance's hot wallet system at approximately 20:05 UTC. Assets worth billions of dollars were then transferred through multiple unauthorized transactions. Binance responded by taking security measures and investigating its systems to identify the source of the compromise.

October 30–31, 2026: FBI Identifies the Attackers

Binance disclosed preliminary findings suggesting that a device belonging to an engineer involved in its operations may have been compromised. On October 31, the FBI attributed the attack to TraderTraitor, a North Korean cyber operations group.

U.S. authorities then asked cryptocurrency service providers to help identify and restrict transactions involving wallet addresses linked to the theft.

Early November 2026: Stolen Funds Begin to Be Frozen

Investigators found that some assets had been converted and transferred through various blockchain services.

Cryptocurrency companies helped trace the transactions, while Binance worked to replenish its affected asset reserves using company resources.

November 12, 2026: DOJ Announces Legal Action

The DOJ confirmed that more than US$2.7 billion in assets had been frozen. Of that amount, more than US$1.2 billion was covered by court authorization for seizure or restriction.

The announcement marked progress in the investigation, although the recovery of all stolen funds remained incomplete.

Read also: iOS Security Vulnerability Threatens Seed Phrases, Binance Issues Warning

Who Is TraderTraitor, the North Korean Hacking Group Behind the Binance Attack?

The FBI identified TraderTraitor as a North Korea-linked cyber operations group responsible for the Binance hack.

The group is known for targeting cryptocurrency companies and individuals with access to valuable systems or digital assets.

In several cases, attacks of this kind have relied on social engineering, which involves manipulating someone into granting access or taking actions that benefit the attackers.

Such methods can include impersonating recruiters, colleagues, or other seemingly trustworthy individuals. In the Binance incident, the company's initial information pointed to a possible compromise of an engineer's device. There were also reports alleging that fake job interviews may have been used in attempts to gain access.

However, these details remain preliminary findings. The full technical sequence of the attack has not yet been confirmed in published investigation results.

The FBI's attribution to TraderTraitor should therefore be distinguished from conclusions about the exact methods used to breach the systems.

How Can Cryptocurrency Stolen in the Binance Hack Be Traced?

Cryptocurrency is often considered difficult to trace because wallet owners do not always use their real identities. However, transactions on public blockchains are recorded and can still be tracked.

When assets leave wallets affected by a breach, investigators can examine destination addresses, transaction times, and links between different fund transfers.

They can then use that information to map the flow of stolen assets. In the Binance case, tracing efforts involved law enforcement agencies, exchanges, and blockchain analytics companies.

When funds are located at services that can cooperate with authorities, transactions may be restricted or assets frozen under applicable procedures.

Why Can't Stolen Funds Be Recovered Immediately?

Finding a transaction does not necessarily mean investigators know who controls the receiving wallet. Attackers can also move assets through numerous addresses, exchange them for other cryptocurrencies, or use cross-chain services.

These activities make tracing more complicated, especially when transactions involve platforms in different jurisdictions. Even so, moving funds does not automatically erase their recorded history.

The biggest challenge is connecting those transactions to assets that can be frozen or taken into custody through legal proceedings.

Read also: NVIDIA Investigates Jensen Huang, Allegedly Targeted by Chinese Intelligence

What's the Difference Between Frozen, Seized, and Returned Cryptocurrency?

Announcements about the recovery of stolen funds often use the terms freezing and seizure interchangeably.

However, the two carry different legal consequences.

In the Binance case, the court authorization covering US$1.2 billion indicates that the government has a legal basis for taking action against those assets.

However, that does not automatically make all the funds government property or mean the money has already been returned to victims. Procedures are still needed to establish ownership and determine how the funds may be distributed.

That is why the value of frozen assets should not be described as the amount already fully recovered.

Read also: Cyberattacks on Indonesian Banks: 214,000 Incidents, Are Customer Funds Safe?

Why Did the Binance Hackers Convert Stolen Assets into ETH?

During the investigation, the FBI found that TraderTraitor converted some of the stolen cryptocurrency primarily into Ether (ETH). The attackers also used various services to move funds to other addresses and networks.

These movements can complicate tracing because investigators must follow a chain of interconnected transactions.

Some transfers involved decentralized finance (DeFi) services, exchanges, and cross-chain infrastructure. However, using multiple services does not make the assets untraceable.

Transaction records on public blockchains can still link wallet activity and reveal where funds were transferred. This is why coordination between law enforcement and cryptocurrency companies is an important part of recovery efforts.

What Is FaceStealer, Another North Korean Hacking Operation?

In the same announcement, the U.S. government also disclosed action against a cyber operation called FaceStealer. The campaign was linked to more than US$400 million in cryptocurrency theft over approximately 18 months.

Unlike a typical attack on exchange infrastructure, FaceStealer exploited victims' trust. The perpetrators impersonated people known to their targets and invited them to fake video meetings.

Recorded video or facial manipulation technology was used to make the meetings look convincing. When an intentionally created technical problem appeared, victims were instructed to take steps supposedly needed to fix their audio or device.

In reality, following those instructions could result in malware being installed, putting the victim's device and digital accounts at risk.

In the latest operation, the U.S. government seized cloud infrastructure used by FaceStealer as well as more than 900 webcam recordings associated with victims.

Was FaceStealer Used to Hack Binance?

There is not enough evidence to establish that FaceStealer was the method used in the October 2026 Binance hack.

Both cases involve North Korean cyber activity, but they are separate operations. The more than US$400 million in theft linked to FaceStealer is also not part of the estimated Binance losses.

Although separate, the cases show that attacks on the cryptocurrency industry do not always depend on technical vulnerabilities. Manipulating users and employees can also create opportunities to steal assets.

Read also: PEPE and UNI Purchased by Wallet Allegedly Linked to Binance Hack

Are Binance Users' Funds Safe Now?

A hack involving billions of dollars naturally raises concerns about funds users hold on Binance. The company stated that it would absorb the financial impact of the incident using internal resources and user protection mechanisms, including the Secure Asset Fund for Users (SAFU).

In an update on November 4, 2026, Binance reported that approximately 98% of the affected assets had been replenished. The company also said it had allocated sufficient resources to cover the losses caused by the incident.

However, replenishing company reserves is different from recovering stolen funds through law enforcement. When Binance uses internal funds to replace affected assets, the objective is to maintain reserves backing users' holdings.

Meanwhile, the funds being frozen and processed by the DOJ are assets traced after the theft. These are separate processes and should not be treated as the same form of reimbursement.

Therefore, Binance's report about replenished reserves does not automatically prove that all stolen assets have been located or that the legal proceedings are complete.

5 Security Lessons from the Binance Hack

The incident demonstrates that cryptocurrency security cannot rely on blockchain technology alone. Devices, internal access, and user behavior also determine how well a system can withstand threats.

Several measures can help reduce the risk of similar attacks.

1. Use strong authentication. Enable passkeys or phishing-resistant two-factor authentication where available.
2. Be cautious of suspicious meeting invitations. Verify the sender's identity before opening links or following technical instructions.
3. Don't install software indiscriminately. Avoid software presented as an audio or video fix when it comes from an untrusted source.
4. Understand the type of wallet you use. Hot wallets are more convenient for active transactions, while cold wallets can reduce certain risks associated with online access.
5. Monitor security announcements. Follow official platform updates when transactions are restricted or an attack is suspected.

These steps do not guarantee absolute protection.

However, understanding how attacks occur can help users recognize warning signs before their accounts or devices are compromised.

Read also: CoinDCX Hack: 15.99 Million USDT Lost, Initially Called a False Alarm

What Will the DOJ and FBI Do Next?

After securing court authorization, U.S. authorities must continue legal proceedings involving the assets they have secured. Investigators are also monitoring movements of cryptocurrency that has not yet been frozen.

At the next stage, the forfeiture process may be used to determine the ownership status of certain assets. If legal requirements are met, secured funds may ultimately be returned to their rightful owners. However, there is still no certainty about when the entire process will be completed.

For the cryptocurrency industry, the case highlights the importance of coordination among exchanges, blockchain service providers, and law enforcement in responding to digital asset theft.

To follow developments in cryptocurrency security, Bitcoin, and global crypto market news, you can sign up for Bittime to receive regular news updates and analysis.

Conclusion

The latest developments in the Binance hack point to progress in law enforcement efforts against large-scale cryptocurrency theft.

The DOJ obtained court authorization to seize or restrict more than US$1.2 billion in assets linked to TraderTraitor, a North Korean hacking group.

Those funds form part of the more than US$2.7 billion in cryptocurrency frozen through cooperation between government agencies and companies in the crypto industry.

However, frozen assets cannot necessarily be returned immediately. Establishing ownership and completing the legal process remain essential steps in recovering the funds.

The case also shows that blockchain transaction transparency can assist investigations, but preventing attacks still requires secure systems, human vigilance, and cooperation across platforms.

Bittime is a licensed Digital Financial Asset Trader (PAKD) regulated and supervised by Indonesia's Financial Services Authority (OJK) — where you can buy Bitcoin in Indonesia and hundreds of other cryptocurrencies starting from IDR 10,000. Registration is fast and secure, and you can get started today.

Track the USDT to IDR conversion rate and the real-time price movements of your favorite cryptocurrencies. Everything is available in one crypto investment app that you can download for free from the Play Store.

Ready to get started? Register with Bittime now and put your investment strategy into action on a platform already trusted by millions of users in Indonesia.

FAQ

How Much Was Lost in the 2026 Binance Hack?

The October 29, 2026, Binance hack is estimated to have resulted in the theft of approximately US$6.3 billion in cryptocurrency. The assets were taken through unauthorized withdrawals from the company's hot wallet system, making it one of the largest reported cryptocurrency thefts.

Which North Korean Hackers Were Behind the Binance Attack?

The FBI linked the attack to TraderTraitor, a cyber operations group associated with North Korea. This identification is an investigative attribution, not a criminal conviction of every individual suspected of involvement.

How Much Stolen Binance Cryptocurrency Has the U.S. Been Authorized to Seize?

The DOJ obtained court authorization to seize or restrict more than US$1.2 billion in cryptocurrency assets. This amount is included in the more than US$2.7 billion already frozen and should not be counted as an additional, separate amount.

Have Binance Users' Funds Been Returned?

Binance reported in its November 4, 2026, update that approximately 98% of affected assets had been replenished using company resources. However, replenishing reserves is different from the U.S. government's recovery of stolen assets, which still requires further legal proceedings.

How Does the U.S. Government Freeze Stolen Cryptocurrency?

Investigators use blockchain transaction analysis to identify wallet addresses and fund flows linked to a hack. This information is then used in cooperation with cryptocurrency service providers to restrict certain transactions and secure assets under applicable legal authority.