Update: DOJ gets court OK to seize $1.2 billion of the Binance hack, about a fifth of the haul

The Justice Department said Thursday that it has court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance on Oct. 29, according to CNBC, Cointelegraph and Fox Business. It also said government and private-sector efforts have frozen more than $2.7 billion of the haul. This follows our earlier reporting on the Binance post-mortem and on how long the laundering is expected to take.

The number behind the number

Three different figures are in circulation, and they mean different things. Using the totals the outlets report, here is how they compare.

Figure	Amount	Share of $6.3 billion
Total impact Binance reports	about $6.3 billion	100%
Frozen by government and private partners	more than $2.7 billion	about 43%
Court-authorized seizure or restraint	more than $1.2 billion	about 19%

The percentages are our arithmetic ($2.7 billion and $1.2 billion divided by $6.3 billion), and both are floors because the DOJ said "more than." The gap matters. A freeze by an exchange or stablecoin issuer can be lifted. A court-authorized seizure or restraint is the step that puts assets on a path to forfeiture. Roughly $1.5 billion of the frozen total has no court order attached, based on the reported figures.

Roughly $3.6 billion, or a bit more than half, is not reported as frozen at all. The DOJ said the hackers, whom the FBI calls "TraderTraitor," are still laundering through exchanges, bridges and mixing services, so that number is moving.

What Binance has said

Binance said it has finished covering the affected assets from its own funds and published a new proof-of-reserves snapshot that it says shows at least one-to-one backing of customer assets, according to Cointelegraph and Fox Business. That is Binance's statement; we have not independently audited the snapshot. Kim Yo Jong, the sister of North Korea's leader, has denied the country's involvement, Cointelegraph reported.

Fox Business quoted U.S. Attorney Jeanine Ferris Pirro saying authorities worked "to freeze this massive criminal fraud in its tracks."

A second case: FaceStealer

The DOJ separately announced it seized cloud infrastructure used in "FaceStealer," a North Korean social-engineering campaign it says stole more than $400 million in cryptocurrency over 18 months. Per the DOJ's account as reported, the hackers used secretly recorded webcam footage and AI-generated deepfakes of known crypto figures on video calls, then walked victims through fake technical fixes that installed malware. The FBI said it seized more than 900 webcam videos of victims and published a public advisory with protection guidance.

Who this hits

The FaceStealer details are the practical part for anyone who runs a crypto or software business. The reported targets include people working in crypto and Web3, and increasingly developers who maintain open-source software, a route to code repositories and package accounts. The Binance attack itself began, by Binance's account, with a fraudulent job interview that compromised an employee's computer. In both cases the entry point was a video call or an interview with a person who seemed trustworthy, not a flaw in the blockchain. A small exchange, wallet developer or agency that pays contractors in crypto has the same exposure with far fewer defenses than Binance.

For ordinary crypto holders the news does not change what they own. Bitcoin traded near $69,700 on Coinbase Friday morning, about 8% below the $75,700 daily close from a week earlier, based on Coinbase's daily candles read this morning. We did not find a source tying that move to the seizure announcement, and we are not claiming one.

What to watch

• Whether the DOJ files forfeiture actions, which would show where the $1.2 billion sits and under what legal theory.
• Whether the frozen share rises above the roughly 43% reported now, or stalls as the hackers move funds through bridges and mixers.
• Further FBI or DOJ advisories on the video-call and interview tactics.

See the crypto desk and live prices for more.

Sources: CNBC, Cointelegraph, Fox Business, Coinbase Exchange data. DOJ statements are as reported by these outlets. Information, not investment advice.