DOJ says it can seize or restrain over $1.2 billion of the $2.7 billion frozen after the Binance theft

$1.2 billion is 44 per cent of what is frozen and 20 per cent of what was stolen (derived)

The Department of Justice's release of 12 November 2026 prints three sums for the Binance theft, in this order: it says North Korean military actors "stole more than $6 billion" on or about 29 October, that collective efforts have resulted in "the freeze of more than $2.7 billion", and that the Department has already obtained "court-authorization to seize or restrain in excess of $1.2 billion of that amount". Set side by side, the court-authorised sum is 44 per cent of the frozen sum (derived: 1.2 divided by 2.7) and 20 per cent of the stolen sum (derived: 1.2 divided by 6). The frozen sum is 45 per cent of the stolen sum (derived: 2.7 divided by 6). On Binance's own figure of about 6.3 billion dollars, which is Binance's and not the release's, the last two ratios are 19 and 43 per cent (derived).

What that does not establish. Every figure is printed as "more than", so each ratio is a ratio of the printed numbers only. The release does not say how much of the 1.2 billion is seized and how much is restrained, names no court, gives no date for any order, and does not say that any money has been returned. It uses the word "seize" and the word "return" in one sentence, as an intention: "seize and return North Korea's ill-gotten gains". The page also never uses the word "frozen" (derived: zero matches); it says "freeze" four times. This briefing keeps the four words apart because they mean different things to the person whose money it is (see the section on the words).

The Department writes and times its own release and credits itself and its partners; Binance is the victim of the theft and a commercial exchange, not a party at fault. The FBI's technical report on the FaceStealer scheme, announced in the same release, is covered in a separate briefing on this site; this one covers the money and the legal actions. This site's earlier briefings on the theft are the 30 October briefing and the 1 November briefing on the FBI alert; this briefing records what the release adds to them.

The figures, in the order the page gives them

The page states the stolen total and the frozen total itself. It prints "more than $6 billion" and "more than $2.7 billion". It does not print 6.3 billion; that figure is Binance's, from its notices of 30 October. The release's other large figure, "the theft of more than $400 million worth of cryptocurrency", belongs to the FaceStealer scheme and is a different matter. It is not part of the Binance ledger and should not be added to it.

Two cautions. First, the ratios compare lower bounds with lower bounds, so they say how the printed numbers relate, not the true shares. Second, the release gives no valuation basis. Crypto prices move, and "worth" does not say at what price or on what day. The Criminal Division's "about half" sits at 45 per cent on the release's own numbers (derived), so the half that was halted is the frozen sum, not the sum with a court order behind it, which is about a fifth.

Zoom

Frozen, restrained, seized, forfeited, returned: the release uses more than one

The five words describe five different positions for the same money. The release uses four of them, in different places and for different dollars, and the fifth, returned, only as an intention. Counts are of the release body, derived by this site.

The 1.2 billion in three verbs. The opening paragraph says the court-authorised "seizure and restraint". The body says the Department obtained authorisation to "seize or restrain". The District of Columbia quote says "seizing". "And" and "or" are different claims: one says both happened, the other says either was authorised. Nothing on the page says how many of the dollars are in each state, or that any step beyond the authorisation has been taken.

What the words mean for the account holder (this site's general explanation, not the release's). A freeze is a hold placed by a provider or token issuer; in earlier reporting read for this site's 30 October briefing, the stablecoin issuers and one network council did the freezing, and nothing changes hands. A restraint is a court order that stops the holder disposing of property while a case runs; ownership is unchanged. A seizure moves possession to the government under a court order, and the owner can still contest it. Forfeiture is the court step that transfers title, and claimants must file in that process. A return is what can follow it. This is a general account of how these terms are used in US practice, and anyone affected should take legal advice.

Zoom

Labels that stand in for a legal status

Several phrases in the release read as outcomes and are not statuses. The Criminal Division says its partners froze the assets "before they got beyond law enforcement reach", and the District of Columbia U.S. Attorney says the fraud was frozen "in its tracks". The section's heading says the Department and its partners "Interdict" more than a billion dollars. "Interdict" is not a status a court order or an exchange notice would use, and the body uses it for the stolen assets generally: "worked closely with virtual asset service providers (VASPs) to interdict the stolen assets". A reader holding an exchange notice or a court document should look for the actual word: frozen, restrained, seized, forfeited or returned.

The same release says efforts to "trace, freeze, seize, and forfeit" are ongoing. That sentence is the only place "forfeit" appears, and it describes work in progress. It states no forfeiture complaint and no forfeiture order. The release says nothing about a victim claims process either.

Who announced what, and who is quoted

The release is from the Department's Office of Public Affairs and lists five components: the Criminal Division's Computer Crime and Intellectual Property Section, the FBI, the National Security Division, and the U.S. Attorney's Offices for the Central District of California and the District of Columbia. Two actions sit under two headings. The Central District of California section announces "the disruption of cloud-based infrastructure" used in the FaceStealer scheme. The Binance section is headed "Separately from the FaceStealer campaign".

What the page does not say is which office obtained the authorisation for the 1.2 billion dollars. The only use of a warrant is for the FaceStealer webcam videos: "Pursuant to a federal warrant, the FBI seized over 900 webcam videos of FaceStealer victims". The release attributes the theft to "members of the North Korean military, referred to by the FBI as "TraderTraitor"". It does not name the court, the type of order, or the district that filed it. This briefing names no suspect and no victim beyond the exchange the release names.

What the release adds to briefs 519 and 557, and where it differs

This site's 30 October briefing found no government statement on the theft. Its 1 November briefing recorded the FBI's alert dated 31 October, which gave no frozen total and no unit. The release moves both: it adds a frozen total and a court-authorised sum, and it is the first Department statement read here. Where it and the earlier records differ, the difference is kept below and not resolved.

Two points stand out. The release's frozen figure carries no time, so it cannot be told whether it is a 30 October count repeated or a 12 November count. And the last row matters for the question of return: Binance says it has covered about 95 per cent of the loss from its own funds, and the release says only that the Department will use every tool to seize and return North Korea's ill-gotten gains in general. Who is a claimant for the returned money is not stated.

What the release states, and what it does not

The page gives no indicator of any kind for the Binance part: no address, hash or domain. The only web address it prints is a government resource page for the FaceStealer scheme, which belongs to the separate briefing.

What to do, in order

Technical details

The Binance part of the release prints no technical indicator: no wallet address, transaction hash, domain, file name or version string, and this briefing does not invent any. What it does print are two sentences that carry the money. They are copied exactly below. A reviewer uses them to check the wording against the page: the first states the freeze and the court authorisation in one sentence, and the figure that follows "of that amount" refers back to the frozen sum.

Collective U.S. government and private sector efforts so far have resulted in the freeze of more than $2.7 billion, with the Department having already obtained court-authorization to seize or restrain in excess of $1.2 billion of that amount.

The next block is this site's arithmetic. It is derived, not stated by the Department, and every input is a printed "more than" figure, except 6.3, which is Binance's. A reader can reproduce it from the sentence above and the figures in the release.

1.2 / 2.7 = 0.444 (44 per cent)
1.2 / 6   = 0.200 (20 per cent)
2.7 / 6   = 0.450 (45 per cent)
1.2 / 6.3 = 0.190 (19 per cent, Binance's figure)
2.7 / 6.3 = 0.429 (43 per cent, Binance's figure)

Two more blocks. The first is the one web address the release prints, defanged as a precaution, and the second holds the identifying lines of the release so a reader can find the page and check the date.

www[.]fbi[.]gov/facestealer

Press Release Number: 26-1356
Thursday, November 12, 2026

The question the release leaves open

The release says about 1.2 billion dollars is under a court authorisation and that more than 2.7 billion is frozen. That leaves about 1.5 billion (derived: 2.7 minus 1.2, an approximation) with no stated legal basis beyond a private hold. Which court, which order and which dollars sit in that 1.2 billion, and what happens to the rest and to the returns the Department says it will seek?

Key facts