US Court Order Targets $1.2 Billion in Binance Hack Funds

The US Order Covers Part of the Binance Hack Proceeds

The US Justice Department has court approval to seize or restrain more than $1.2 billion connected to the October 29 Binance hack. The FBI has attributed the breach to a North Korean state hacking unit it calls “TraderTraitor.” The order is a significant legal step, but it addresses only part of the funds traced after the incident. The department says recovery efforts are continuing as investigators and industry participants try to keep the stolen assets from moving beyond reach.

The Justice Department announced the court action on November 12. It concerns assets within a much larger pool that government agencies and private-sector partners have frozen since the theft. Their combined freezes exceed $2.7 billion, according to the department’s announcement. The $1.2 billion figure therefore should not be read as the total amount recovered or as the full value of the hack; it describes the assets covered by this particular court order.

Assistant Attorney General Tysen Duva credited the Justice Department’s Criminal Division with helping secure early freezes. He said the division used its digital-asset expertise to halt about half of what he described as the historic breach. The order formalizes a government effort that has involved cooperation with the digital-asset industry. It does not, on its own, establish that all targeted funds have been forfeited or returned; the department said work to recover assets remains ongoing.

Billions Remain in Motion or Outside the Freeze

The gap between the court order and the wider estimates underscores how much of the case depends on tracing assets across blockchains and services. Onchain Lens, citing Arkham Intelligence data, put the total haul at about $6.34 billion in an update earlier in the week. That estimate is not the same measure as the amount covered by the court action. It offers a broader accounting of the stolen funds and helps explain why investigators are pursuing activity beyond the assets already frozen.

In its breakdown, Onchain Lens estimated that roughly $2.85 billion remained accessible to the hackers, while $2.60 billion had been frozen. It separately listed about $891 million as potentially moved or laundered. Those categories describe the status indicated by the cited on-chain analysis, not a final government accounting. In particular, funds assessed as potentially moved or laundered may be difficult to track or recover, but the estimate does not establish that every such asset is permanently lost.

The firm’s figures put total remaining holdings at about $5.45 billion when the accessible and potentially moved or laundered amounts are considered together. That total and the $2.7 billion in government and industry freezes are reported in different contexts, so they should not be treated as a single reconciled ledger. The figures nevertheless show the scale of the unresolved tracing task: a court order targeting more than $1.2 billion is only one part of a much larger effort to locate and immobilize funds.

Laundering Routes Complicate Recovery Efforts

Investigators say the hackers have routed funds through bridges, mixers and exchanges, tactics that can make following the trail more complex. The Justice Department cited these continuing movements as a reason recovery work is not over. Onchain Lens also reported activity through the cross-chain protocols THORChain and Chainflip during the few days before its update. Transfers between services and networks create a moving picture, making a fixed snapshot of frozen or accessible funds liable to change as addresses and assets are tracked.

Elliptic reported tracking about 1,650 Bitcoin in new addresses by November 6. The firm said the coins came from other stolen assets, and that some funds later reached the Tornado Cash mixer. This is a separate tracing detail from the estimates of the overall Binance hack haul. It shows that investigators and analytics firms are monitoring related flows and destinations, but the supplied information does not specify how much of that Bitcoin was recovered or whether the movement changed the broader total.

The FBI, Secret Service and IRS-CI have urged crypto service providers to block addresses linked to the laundering activity. That request places exchanges and other services in a practical position to help prevent suspicious funds from being moved further. Onchain Lens questioned whether the hackers could move another $1 billion before THORChain and Chainflip restrict linked wallets. That was a question raised by the analytics firm, not confirmation that either protocol had imposed restrictions or that the additional movement had occurred.

Customer Reimbursement Is Separate From Seizure

The public figures do not settle how much money will ultimately be forfeited. A freeze can limit a holder’s ability to move assets, while the court-approved seizure or restraint gives the US a legal route to pursue the targeted pool. The Justice Department’s announcement describes authority over more than $1.2 billion, not a completed distribution to victims. The distinction matters because the reported frozen totals, court action and any eventual recovery are different stages of a process that is still underway.

For Binance customers, the exchange says the security incident did not leave them short of the affected assets. Binance said it replaced every token lost in the hack using its treasury and insurance funds, and that customer assets impacted by the incident had been covered. It also announced a new Proof of Reserves snapshot, saying users could independently verify at least 1:1 backing once the zero-knowledge proof was generated. These are the exchange’s statements about customer coverage, not the outcome of the US forfeiture case.

Binance’s reimbursement statement means any funds eventually forfeited by the US would not change what customers hold, according to the exchange. The remaining questions concern the assets still accessible, the funds classified as potentially moved or laundered, and whether services can restrict further transfers. The Justice Department says recovery continues, while on-chain estimates capture a developing situation rather than a final result. Neither the court order nor the reported freezes establish how much of the total haul will ultimately be recovered.

Source: BeInCrypto