US has court authority to seize $1.2 billion of crypto stolen from Binance, Justice Department says

The US Justice Department said on Thursday, November 12, 2026, that it has court authorization to seize or restrain more than $1.2 billion of the cryptocurrency stolen from Binance on October 29. The amount is part of more than $2.7 billion that government agencies and private companies have frozen since the theft, according to the department's announcement.

What the Justice Department announced about the Binance theft

Freezing an asset stops it from being moved. A court order to seize or restrain it is a further legal step toward forfeiture, in which the government takes ownership, as Bitcoin Magazine described it. The department said "collective U.S. government and private sector efforts so far have resulted in the freeze of more than $2.7 billion," and that it had "already obtained court-authorization to seize or restrain in excess of $1.2 billion of that amount."

The announcement does not say which assets are covered or in which court the orders were issued, and the court papers were not published with it, Bitcoin Magazine reported. It also does not say when or how any seized funds would be returned.

Assistant Attorney General A. Tysen Duva, of the department's Criminal Division, said in the announcement that the division used its expertise to "immediately halt about half of this historic breach." The department's figure of "more than $6 billion" for the theft is less precise than the more than $6.34 billion that Binance says it has covered from its own funds.

The department's statement that North Korea is responsible follows the FBI's earlier public attribution, which we reported. North Korea rejected the claims as "absurd rhetoric" in a statement carried by state media on November 3, in response to the FBI. No charges against named people were announced.

The FaceStealer scheme

The second action targets a method of stealing from people who work in crypto. According to the department, hackers it links to North Korea invite a target to a video meeting from an account stolen from an earlier victim. During the call they record the target's webcam and play a recorded video of someone the target knows, or a deepfake of a well-known person in the industry.

They then fake a technical problem, such as saying the target cannot be heard, and send a link to fix it. The link installs malware, the department said. In several reported cases the theft came months to more than a year after the first compromise.

The FBI seized more than 900 webcam videos of victims under a federal warrant, according to the announcement. It said the hackers have increasingly targeted people who develop and maintain open-source software, which "appears calculated to enable software supply-chain attacks." The FBI published a report on how the scheme works and set up a page of resources at fbi.gov/facestealer, the department said.

Why it matters

After the theft, Tether and Circle froze more than $2.5 billion of stablecoins tied to the stolen funds. A freeze by an issuer does not by itself return anything to anyone; a court order is what lets a government take control of the assets. The announcement shows that step has started for less than half of what is frozen.

What it could mean for traders

For Binance customers, nothing changes directly: the exchange says it has already replaced the affected tokens. The practical lesson is in the second half of the announcement. In our assessment, the FaceStealer method works because the caller appears to be someone the target already knows, and the department says the targets are people who work in the cryptocurrency and web3 industries and, increasingly, people who develop and maintain open-source software. The department points readers to fbi.gov/facestealer, which it describes as the FBI's hub for resources and information on the scheme.