U.S. Targets $1.2 Billion From Binance Hack—Where Is the Rest?

The Binance hack recovery has reached a significant milestone: U.S. authorities say more than $1.2 billion in stolen cryptocurrency is subject to court-authorized seizure or restraint. But that headline leaves a much larger question unanswered: what happens to the rest?

The Justice Department’s November 12 announcement puts the broader frozen total above $2.7 billion following the October theft. Crucially, the $1.2 billion is included in that figure. Adding the two would exaggerate the recovery, while calling either sum customer repayments would go further than the announcement supports.

Separately, Binance says it has completed coverage of the affected assets, having committed more than $6.34 billion in company funds to source replacement tokens through market and over-the-counter purchases. Its update says withdrawals continue reopening in phases.

That is a distinct milestone: replacing assets from company resources restores backing without recovering the original coins from the attackers. The law-enforcement totals should therefore not be read as a measure of how much Binance has replaced for customers.

Binance hack recovery: three numbers, three meanings

The FBI attributes the attack to North Korea’s TraderTraitor actors and dates the theft to around October 29. Its alert values the stolen assets at more than $6 billion.

That is the starting point. The frozen total describes assets intercepted by government and private-sector efforts. The court-authorized figure identifies a portion covered by seizure or restraint authority. Those are stages of intervention, rather than three separate piles of money.

“We worked together to freeze this massive criminal fraud in its tracks,” U.S. Attorney Jeanine Ferris Pirro said in the DOJ statement.

The language matters because a successful interception is not the end of a recovery. Establishing control, resolving legal claims and determining how assets can be returned are different questions. The announcement gives no timetable for completing that process.

The trail runs through Ether and crypto’s trading infrastructure

The FBI’s October 31 alert said investigators had observed stolen assets being converted primarily into Ether. It warned of further laundering through decentralised finance and instant-swap services and published addresses associated with the operation.

Its appeal extended beyond large exchanges to THORNode operators, RPC providers, DeFi services and blockchain analytics firms. That breadth illustrates the problem: stopping a theft’s proceeds requires action across the routes used to move and exchange them.

Public ledgers can preserve a transaction trail without guaranteeing that every destination can freeze assets. Investigators need both visibility and a point where someone can act. A traceable transfer and a recoverable balance are not the same thing.

For readers following the numbers, a precise remaining-loss estimate would be premature. These are dollar valuations of crypto assets, and the authorities describe lower bounds. Without matching valuation times and complete balances, subtracting one headline from another produces an impression of precision the disclosures do not provide.

A separate operation exposes the human weakness

The same enforcement announcement addressed FaceStealer, a separate North Korean social-engineering campaign. The FBI’s dedicated account of the scheme describes attackers hijacking communication accounts, recording victims’ webcams and using convincing imposter video meetings to compromise new targets.

According to the bureau, that campaign caused more than $400 million in theft over 18 months. Investigators seized over 900 victims’ webcam recordings. Those figures belong to FaceStealer and should not be added to the Binance recovery figures as though they describe one incident.

The disturbing element is the use of familiarity. A message can arrive through a compromised account belonging to someone the target knows. Recorded footage can then make an imposter meeting look like a conversation with a trusted contact.

The FBI also warns that open-source developers and maintainers are being targeted. Access to a developer’s software repository can put downstream users at risk, extending the consequences beyond whatever cryptocurrency is on the initial victim’s device.

Why a blockchain audit is only part of the defence

The implication is uncomfortable for technically sophisticated users: recognising a face, a familiar username or a plausible work request is insufficient authentication. Verification needs a separate route that the suspicious conversation does not control.

A request to install software or change a device during an unexpected meeting deserves particular scrutiny. For teams, the useful question is whether one compromised employee account can reach both operational systems and valuable assets. Separating those permissions can limit the damage.

This is a different threat from a flaw in Bitcoin’s underlying software. BNC’s Bitcoin Core security disclosure coverage explains why identifying the affected layer matters. A sound protocol does not protect a user who grants an attacker access to a device or signing process.

What would make the next update meaningful?

The most useful follow-up would distinguish newly frozen assets from previously announced balances, identify progress toward final recovery and explain whether funds have actually been returned. A larger number alone may conceal very different legal and operational outcomes.

The Binance case shows both sides of crypto’s transparency: stolen funds can remain visible as they move, yet visibility does not automatically stop them. The recovery effort has established a substantial foothold. The unanswered story is how much of that foothold can become a completed recovery—and how much remains beyond reach.

For exchanges, the practical test is readiness before the next incident: knowing who can authorise a response, preserving records and maintaining contact with the services that might receive stolen assets. A recovery operation becomes harder when those relationships must be assembled after funds have started moving.