DOJ gets court authority over $1.2 billion tied to Binance theft

The U.S. Justice Department said Thursday that it had obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency tied to the October theft from Binance, advancing the government’s effort to keep the assets beyond the alleged attackers’ reach.

The November 12 disclosure is a legal and custodial step, not a final forfeiture judgment or confirmation that victims have been repaid. The department said the amount was drawn from more than $2.7 billion already frozen through combined government and private-sector efforts. The figures therefore overlap: the $1.2 billion is not an additional recovery on top of the $2.7 billion.

The Associated Press reported the new action after the Justice Department’s announcement. The FBI had previously attributed the underlying theft to North Korea and identified the activity as TraderTraitor. Its October 31 alert said more than $6 billion in virtual assets had been stolen from Binance on or about October 29.

Freeze, seizure and forfeiture are different stages

A private-sector freeze can prevent assets from moving while ownership and legal process remain unresolved. A court-authorized seizure or restraint gives the government legal authority to take custody of property or block its disposition, depending on the order and the asset involved. Neither action, by itself, establishes final ownership.

Forfeiture generally requires a further proceeding in which the government must establish that the property is legally subject to confiscation. Other parties may assert claims, and a court ultimately determines the disposition of contested assets. The Justice Department did not publish, in the records opened for this report, an asset-by-asset inventory, the relevant wallet addresses, the valuation timestamp or the specific division between property authorized for seizure and property subject only to restraint.

That missing detail limits comparisons with Binance’s earlier estimate that the incident affected approximately $6.3 billion. The FBI’s public alert used the broader formulation of more than $6 billion, while the Justice Department described more than $2.7 billion as frozen and more than $1.2 billion of that pool as covered by court authority. These are agency and company valuations reported at different stages, not a reconciled accounting at one market-price snapshot.

The laundering effort remains active

The FBI’s October alert said TraderTraitor actors had been converting stolen assets primarily into ether and were expected to use decentralized-finance services and instant-swap providers in later laundering stages. The bureau published addresses it said held or had held assets connected to the theft and asked exchanges, node operators, analytics firms and other service providers to block related transactions.

The request illustrates the operational limits of asset recovery across cryptocurrency networks. Centralized issuers and custodial services may be able to freeze particular balances or accounts. Assets under direct control of a wallet holder generally require interception at a cooperative service, recovery of signing authority or another enforceable mechanism before the government can take custody.

The disclosed court authority covers less than half of the more than $2.7 billion frozen figure and less than one-fifth of Binance’s approximately $6.3 billion incident estimate. Those comparisons use the agencies’ and company’s rounded dollar figures rather than contemporaneous token quantities, so changing cryptocurrency prices and undisclosed valuation methods prevent a precise recovery rate.

What remains unresolved

The government’s announcement does not show that the authorized assets have all been transferred into government-controlled wallets. It also does not identify a timetable for forfeiture proceedings, repayment or release of property to Binance or its customers.

The most defensible conclusion on November 12 is narrower: U.S. authorities moved part of the previously frozen pool into a court-authorized seizure or restraint process. Tracing, laundering interdiction and any final determination of ownership remain unfinished.