Crypto · Security

US gets court approval to seize $1.2B from the Binance hack as $2.7B sits frozen. What it means for traders

By VoxTradePro Desk · Published 13 Nov 2026, 08:13 UTC+8 · 3 min read

The US Justice Department won court approval to seize or restrain $1.2B stolen from Binance, with $2.7B frozen. Why it matters for traders.

Two weeks after the largest exchange theft on record, US authorities have their first big legal win. On 12 November the Justice Department said it had court authorization to seize or restrain more than $1.2 billion of the crypto stolen from Binance, out of more than $2.7 billion now frozen. For traders, this is less about a price spike and more about a rule of the market getting clearer: large thefts are getting harder to cash out, and stablecoin issuers sit at the centre of that.

Key takeaways

More than $1.2B is court-authorized for seizure or restraint; it is part of the $2.7B+ frozen, not an extra amount (US DOJ, 12 Nov).
Binance put the 29 October loss at about $6.3B and says it has completed coverage for affected customers (The Block, 12 Nov).
DOJ also seized infrastructure behind FaceStealer, a fake video-call campaign linked to $400M+ in crypto thefts over 18 months.
The practical lesson is security hygiene, not a trade signal: hardware wallets, app-based 2FA and withdrawal allowlists.

What the Justice Department announced

The DOJ said the FBI attributes the Binance breach to North Korean military hackers it calls TraderTraitor, who stole more than $6 billion in virtual assets on or about 29 October. Since then, prosecutors and the FBI have worked with exchanges and other service providers to stop the funds moving. According to the department, combined government and private-sector efforts have frozen more than $2.7 billion, and it already holds court orders covering more than $1.2 billion of that.

Bloomberg reported that the freezes came from Tether and Circle, the two biggest stablecoin issuers, in the immediate aftermath of the break-in. A DOJ official said the quick action halted about half of what he called a historic breach. The department added that tracing is ongoing because the attackers keep laundering the rest through bridges, mixers and exchanges.

Frozen, seized, returned: three different steps

These numbers are easy to misread. A freeze means an issuer or platform blocks transfers. A seizure or restraint order gives the government legal control. Forfeiture and return come later through the courts and can take months or years. So the $1.2B is not money back in anyone's account today.

There is also a twist on who benefits. Binance says customers are already made whole from its own funds, so any recovered assets would mainly reduce the exchange's own loss rather than change user balances.

The deepfake call campaign every trader should know

Separately, the DOJ said it seized cloud infrastructure used in FaceStealer. According to the department and The Record, attackers used hijacked accounts to invite targets to Zoom or Teams-style calls, played recorded or deepfake video of someone familiar, faked a technical glitch, then pushed a "fix" that installed malware. The FBI also obtained a warrant covering more than 900 webcam videos of victims.

Binance itself said the original breach began with an engineer compromised through a fake job interview, Bloomberg reported. The common thread is people, not code.

How this news moves prices (and what to watch)

Hack headlines tend to hit sentiment first and fundamentals later. Recovery news is mildly supportive because it reduces the chance of forced selling of stolen coins, but it rarely drives price on its own. At 08:08 Macau on 13 November, CoinGecko showed Bitcoin near $71,426 (about -3.4% in 24 hours) and Ether near $2,017 (about -1.9%), so the wider market mood is still risk-off.

Watch next:

Forfeiture filings showing which assets are held, and in which tokens.
Whether more of the remaining stolen funds get frozen as they cross bridges and exchanges.
Any debate over stablecoin freeze powers, which cut both ways for holders.

Practical checklist

Keep long-term coins in self-custody on a hardware wallet; keep only active trading funds on an exchange. Our guide on whether crypto is safe on an exchange goes deeper.
Use app-based or hardware-key 2FA instead of SMS, and turn on withdrawal address allowlists.
Treat any "install this to fix your camera or audio" request during a call as a red flag and leave the call.
Size positions so a sudden hack-driven drop does not force you out; see risk management basics. You can rehearse that in our paper trading simulator with no real money.

Sources

Not financial advice. This article is for general information and education only. It is not a recommendation to buy, sell or hold any asset. Prices move quickly and figures quoted may already be out of date; markets involve risk, including the loss of capital. See our disclaimer.

Related markets: Bitcoin Ethereum BNB