US Moves to Seize $1.2 Billion From Binance Hack. Where Is the Rest?

The US Justice Department has court approval to seize or restrain more than $1.2 billion stolen from Binance. The money comes from the October 29 hack the FBI pinned on North Korea’s state hacking unit.

That covers less than a fifth of the haul. On-chain data shows billions more still within the Binance hacker’s reach.

A $1.2 Billion Slice of a $2.7 Billion Freeze

The Justice Department announced the action on November 12 in a release. The FBI attributed the Binance hack to a North Korean unit it calls “TraderTraitor.”

Government and private-sector efforts have frozen more than $2.7 billion so far. The $1.2 billion court order targets part of that frozen pool. 

Assistant Attorney General Tysen Duva credited the DOJ’s Criminal Division with the early freezes.

“As the Department’s liaison to the digital asset industry, the Criminal Division quickly and efficiently used its expertise to immediately halt about half of this historic breach,” Duva said.

Binance customers, meanwhile, are already covered. The exchange said it replaced every token lost in the hack from its own treasury and insurance funds. Any funds the US eventually forfeits would therefore not change what users hold.

Binance has completed coverage of assets impacted in the security incident and we have published a new Proof of Reserves snapshot. Once the zero-knowledge proof is generated, users can independently verify that their assets are backed at a minimum of 1:1 -…

— Binance (@binance) November 12, 2026

Follow us on X to get the latest news as it happens

The DOJ said its recovery work continues because the hackers keep routing funds through bridges, mixers, and exchanges.

Where the Rest of the $6.34 Billion Sits

On-chain data shows how far that laundering has gone so far. Onchain Lens put the total haul at about $6.34 billion in an update earlier this week, citing Arkham Intelligence data.

Roughly $2.85 billion remains accessible to the hackers. The remaining $891 million may have already been moved or laundered, the firm said.

Over the past few days, the hackers also moved funds through cross-chain protocols THORChain and Chainflip.

LET'S NOT FORGET THE BINANCE HACKERBINANCE HACKER HAS LAUNDERED NEARLY $900MOf the estimated $6.34B hack:• $891.37M potentially moved or laundered• $2.85B remains accessible• $2.60B frozenTotal remaining holdings: $5.45B.Over the past 2–3 days, the hacker has been… pic.twitter.com/R9Cnc7U4wY

— Onchain Lens (@OnchainLens) November 10, 2026

Meanwhile, blockchain analytics firm Elliptic tracked about 1,650 Bitcoin (BTC) in new addresses by November 6. The coins came from other stolen assets, and some funds later reached the Tornado Cash mixer.

Earlier, the FBI, Secret Service, and IRS-CI urged crypto service providers to block addresses tied to the laundering. Onchain Lens questioned whether the hackers could move another $1 billion before THORChain and Chainflip restrict the linked wallets.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights