DOJ wins court approval to seize or restrain $1.2 billion from North Korea-linked Binance hack

The US Department of Justice (DOJ) has obtained court authorization to seize or restrain more than $1.2 billion of the more than $6 billion stolen from Binance on or around October 29, 2026, in a theft it attributes to North Korean military-linked hackers known as TraderTraitor.

The funds are part of more than $2.7 billion frozen by US authorities and private-sector partners, the DOJ said on November 12, 2026.

US authorities secure legal action against stolen Binance funds

The November 12 announcement provides a clearer picture of the US government’s efforts to pursue assets connected to the October theft.

Authorities have obtained judicial authorization covering more than $1.2 billion in Binance funds, although the DOJ has not provided a detailed breakdown showing how much of the amount has been formally seized and how much remains under restraint.

The DOJ also reported that the broader recovery operation had resulted in more than $2.7 billion being frozen through combined government and private-sector efforts.

The latest development therefore represents legal progress rather than confirmation that all affected parties will receive compensation. The investigation remains active, and authorities must still establish the final status of the assets before any potential distribution can take place.

North Korean-linked hackers identified in October theft

The DOJ attributed the theft of more than $6 billion on or around October 29 to North Korean military-linked actors identified as TraderTraitor.

According to the department, the attackers have continued attempting to move the stolen cryptocurrency through different parts of the digital asset ecosystem.

These methods reportedly include cryptocurrency bridges, mixing services and exchanges, which can complicate efforts to establish the origin and destination of transactions.

Cryptocurrency bridges allow assets to move between different blockchain networks, while mixers are designed to make transaction trails more difficult to follow.

When criminals combine these services with transfers across multiple platforms, investigators face additional challenges in identifying and restricting the stolen funds.

The involvement of a North Korean-linked hacking group also raises broader concerns about the security of cryptocurrency infrastructure.

State-linked cyber operations have increasingly attracted attention from international authorities because stolen digital assets can potentially support wider criminal and financial activities.

The ongoing pursuit of Binance funds also illustrates how blockchain transparency can assist investigations, even when attackers attempt to conceal their activities through sophisticated transaction methods.

Binance’s compensation commitment and recovery efforts

Binance had previously addressed the financial implications of the incident in an update published on November 3.

The exchange committed to absorbing the losses associated with the stolen assets and stated that it had reserved more than 100% of the amount required to cover the financial impact.

That commitment is particularly relevant because the recovery of stolen cryptocurrency and the exchange’s ability to cover its losses are separate matters.

Even if authorities successfully recover a portion of the stolen assets, the exchange’s compensation commitment provides another potential layer of financial protection.

The latest court authorization does not necessarily change Binance’s existing commitment. Instead, it advances the separate process of identifying, securing and potentially forfeiting cryptocurrency connected to the attack.

The amount recovered by authorities, the amount ultimately forfeited and the exchange’s own financial arrangements may not necessarily be identical.

As investigations continue, the treatment of Binance funds will remain an important indicator of how cryptocurrency exchanges and government agencies respond to large-scale security incidents.

Victims still face uncertainty over compensation timeline

Despite the progress, the most significant unanswered question concerns when recovered cryptocurrency could reach the people or entities affected by the theft.

The DOJ’s announcement did not establish a timetable for distributing the assets. It also did not identify the final recipients or explain precisely how any eventual compensation would be allocated.

Under the US government’s general asset recovery framework, compensation through remission typically requires authorities to identify the relevant assets, secure them and complete forfeiture proceedings before considering payments to eligible victims.

Court authorization provides an additional enforcement mechanism, but it does not independently establish that the assets are ready for distribution.

The difference between the more than $2.7 billion frozen and the $1.2 billion covered by the reported court authorization also deserves attention. The two figures describe different stages and scopes of the recovery operation and should not be treated as interchangeable.

The pursuit of Binance funds has entered a new legal phase, but the outcome will depend on the progress of forfeiture proceedings, the continued tracing of assets and decisions concerning eligible recipients.

The development is encouraging for cryptocurrency security and accountability. However, until authorities confirm completed forfeitures and establish a distribution process, the financial recovery of affected parties remains uncertain.