Security15 November 2026

Binance hack: DOJ seizure of $1.2bn, what it means

The US Department of Justice can seize $1.2 billion from the Binance hack. What that means for your balance, and what FaceStealer is.

On 12 November 2026 the US Department of Justice (DOJ) announced that a court has given it permission to seize or restrain more than $1.2 billion in stolen Binance crypto. According to the DOJ, the theft of more than $6 billion on or around 29 October was the work of TraderTraitor, the FBI's name for members of the North Korean military. In the same announcement the DOJ describes a second case, FaceStealer, which could affect you too: fake video meetings that install malware. This article sets out the facts and explains what does and does not follow from them for you as a user of a European exchange.

Binance hack and seizure in short

Seizure: more than $1.2 billion that a court gave permission to seize or restrain. The DOJ does not name the court.
Frozen: more than $2.7 billion, by the US government and private parties together. That is more than the seized amount: freezing and seizing are two separate steps.
Stolen: more than $6 billion according to the DOJ. Binance itself puts the affected funds at $6.34 billion.
Perpetrator: according to the FBI, TraderTraitor, a name for members of the North Korean military.
Still ongoing: the DOJ says TraderTraitor is still moving money out through bridges, mixers and exchanges.
Second case: FaceStealer, a scam using fake video calls, responsible for more than $400 million in theft over 18 months.
Users: the DOJ announcement says nothing about returning or compensating Binance customers.

What the DOJ announced on 12 November

The press release (number 26-1356) has two parts. The first concerns the Binance theft: more than $6 billion in virtual assets, stolen on or around 29 October. The DOJ says that efforts by the government and the private sector have frozen more than $2.7 billion, and that it has court permission to seize or restrain more than $1.2 billion. The announcement also says the FBI has issued a Cyber Alert asking parties that provide crypto services to block transactions involving the associated addresses.

The second part is FaceStealer. According to the DOJ, the US Attorney's Office for the Central District of California has taken down cloud infrastructure used in the scheme, and the FBI seized more than 900 webcam videos of victims under a federal warrant.

Bitcoin Magazine writes on 12 November that the seized amount of $1.2 billion is part of the roughly $2.85 billion that Binance described on 3 November as frozen or intercepted, and that those funds had previously been held by token issuers. That is a secondary source; the court documents were not published with the announcement.

Seizure, freezing and return: three different things

The hack is not over just because there has been a seizure. Below is what the three terms mean, and what the DOJ says about each in this announcement.

Step	What happens	What the DOJ reports
Freezing	An issuer (such as a stablecoin issuer) or an exchange locks addresses or funds. The money is not gone, but it does not belong to anyone else either.	More than $2.7 billion
Seizure or restraint	A court gives the government the power to take control of the funds or restrict them.	More than $1.2 billion
Forfeiture	A judge decides that the funds go to the government. The DOJ says it is working on tracing, freezing, seizure and forfeiture; the outcome is not stated.	Not reported
Return	Whoever is entitled to the money gets it back.	Not reported

So the seizure is a step towards forfeiture, not a return. According to CNBC, the DOJ's National Security Division says it is using ‘every tool at its disposal’ to seize North Korea's illegal proceeds and return them; how that will work, and to whom, is not stated.

A worked example

Take the $6.34 billion that Binance itself gives as the affected amount (CNBC, 3 November). The DOJ's figures are ‘more than’ amounts, so the percentages are lower bounds:

Amount	Calculation	Share of $6.34 billion
Frozen, more than $2.7 billion	2.7 ÷ 6.34	at least 42.6%
Seized, more than $1.2 billion	1.2 ÷ 6.34	at least 18.9%
Remainder: not frozen	6.34 − 2.7	at most $3.64 billion

The DOJ does not say how much of the frozen and seized funds is bitcoin. The announcement also uses ‘more than’ for the stolen amount, so the difference from Binance's $6.34 billion cannot be traced.

What Binance says about your balance

Binance says customers lose nothing. The company's commitment is set out in our earlier articles Binance hack: $6.3bn stolen, are your funds safe? and Binance withdrawals reopen: what proof of reserves shows. According to CNBC on 3 November, Binance has made up 98% of the affected funds, and is still buying back less liquid assets. Bitcoin Magazine writes that Binance made up that cover with its own money (the SAFU fund, part of the futures insurance fund and company reserves), not with recovered coins.

That has a practical consequence: according to these sources, whether the government ever returns the money does not determine whether you get your balance back. It determines who ultimately bears the loss. It remains a commitment by the company, not a guarantee from a regulator; in the sources we opened, no European regulator has commented on this hack.

How the attackers got in, and why FaceStealer matters

According to CNBC, co-CEO Richard Teng said on 3 November that the attackers had worked on their access for months. In June they set up a fake developer tool to lure an engineer. In September they posed as recruiters, and a coding task during the job interviews contained hidden malware. Through internal AI tools they reached the system that approves wallet transactions. Teng rejected the idea of a single laptop as the weak point. That differs from the first report on 30 October, in which Binance spoke of a hacked laptop belonging to a DevOps employee.

FaceStealer is a different case, but according to the DOJ it is the same kind of trick: social engineering. The DOJ describes the method like this:

The attackers invite you to a video meeting.
They record your webcam and play recordings or deepfakes of people you trust.
They show you a technical error.
The ‘fix’ they offer installs malware.

The DOJ also says the attackers target open-source developers, possibly to enable software supply chain attacks. Among the names of the perpetrators, the DOJ mentions BlueNoroff and APT38; according to Bitcoin Magazine, the FBI links the campaign to North Korea. The FBI has published a report and a help page for victims (fbi.gov/facestealer); that page could not be opened at the time of writing, so we have not been able to read what exactly it says.

What does this mean for you as a European investor?

Your balance on an exchange. The seizure in the US changes nothing about what Binance promises you. You still depend on a company's commitment. If you are not sure exactly how to store what you own, go through our security checklist.

Take off an exchange what you do not need there. A hack like this shows that money you do not need to trade is safer in your own wallet. With self-custody you are responsible yourself: a lost recovery phrase cannot be recovered. How to choose a wallet is covered in our wallet guide. One example of a hardware wallet is the Blockstream Jade; that offer runs through a partner we work with.

Video meetings. Never install a ‘fix’ or ‘update’ that someone offers you during a meeting. Check through a second channel (phone, a message you start yourself) whether the invitation is genuine. Do not hold meetings with strangers on the device that your wallet or exchange account runs on. This is general advice, not a statement from the DOJ.

Applying for jobs or working in the sector. A coding task from a ‘recruiter’ can contain malware. Run such a task in an isolated environment, not on your own computer. This too is general advice, prompted by what Teng described about the attack.

All countries. This applies in the same way to readers in the Netherlands, Belgium, Germany, France, Spain, Portugal and Poland: the DOJ decision is a US procedure, and the consequences for your balance depend on the exchange where you are a customer, not on your country of residence.

What is not certain yet

Court and documents. The DOJ does not name the court, and the court orders were not published with the announcement.
How much bitcoin. The DOJ does not say how much of the frozen and seized funds is bitcoin.
What happens to the money. The DOJ says it is working on forfeiture. Who the funds are ultimately intended for is not stated in the announcement.
The difference in amounts. The DOJ says ‘more than $6 billion’, Binance $6.34 billion, and the frozen amounts vary by source (more than $2.7 billion at the DOJ, about $2.85 billion at Binance on 3 November, about $3 billion according to CNBC).
How they got in. Binance first spoke of a hacked laptop and later of months of preparation through fake job applications and AI tools. The investigation by an external expert is still under way; who is carrying out the review, its scope and its publication date are not known.
The FBI help page. That page could not be opened at the time of writing, so the details are not included here.

This article is not investment advice. Crypto can fall sharply in value and you could lose your entire stake.

Frequently asked questions

Will I get my money back if the US seizes the Binance loot?

That is not in the DOJ announcement. Binance itself says it has covered all customer losses with its own resources; according to CNBC, 98% of the affected funds have been made up. The seizure in the US is a step towards forfeiture, not a return.

What is the difference between freezing and seizing?

With freezing, an issuer or an exchange locks funds. With a seizure, a court gives the government permission to take control of those funds or restrict them. The DOJ reports more than $2.7 billion frozen and more than $1.2 billion with court permission.

What is TraderTraitor?

It is the name the FBI uses for members of the North Korean military who, according to the DOJ, carried out the Binance theft.

What is FaceStealer?

A scam using video meetings: the attackers record your webcam, play deepfakes or recordings of people you know, and show you a fake error. The ‘fix’ installs malware. The DOJ cites more than $400 million in theft over 18 months.

Should I take my crypto off Binance?

That is your call and we do not give advice. What you do not need to trade can be safer in your own wallet, provided you keep the recovery phrase safe.

Sources

Read on 15 November 2026.

Prices right now

Mid-market price from CoinGecko in euros, updated at 14:50 UTC.All 20 prices