FBI Seizes or Restrains Over $1.2 Billion Stolen in Binance Heist

Synopsis

In a theft of approximately $6.3 billion, the FBI said on Thursday it has seized or restrained over $1.2 billion worth of cryptocurrency stolen from Binance, the world's largest crypto exchange. Altogether, more than $2.7 billion has been frozen by the U.S. authorities and private companies. The FBI has blamed the theft on North Korea's Trader-Traitor group, which Pyongyang denies it is responsible for. In a forfeiture hearing in front of a judge, the recipients of recovery will be determined.

Last month it was reported that it had been stolen, but the process of the recovery is just underway. On Thursday, the FBI announced it had arrested more than $1.2 billion of cryptocurrency that it claimed was stolen from Binance, the world's biggest cryptocurrency exchange. The theft of about $6.3 billion is regarded as the biggest crypto heist in history.

According to the authorities

The wording matters. The stolen money has been frozen by the US government and the private sector in excess of $2.7 billion. Now, the Justice Department says it has acquired court permission to confiscate or otherwise hold over more than $1.2 billion of it. This represents approximately 43 per cent of the value of the property stolen and approximately 19 per cent that is under seizure or restraint orders. No items have been returned yet.

The next step is — the legal one. The government will normally file a claim of forfeiture in front of a judge who will decide who can rightfully claim to recovered money.

Who is to be blamed

The FBI has previously blamed the theft on a North Korea hacking group called TraderTraitor. North Korea has pledged its innocence and Kim Yo Jong, a high-ranking North Korean official, said the FBI investigation was “a trite provocation.”

FBI made second attribution Thursday. It accused North Korea of a different ploy that siphoned $400 million in bank funds over 18 months, which was named FaceStealer. The plan involves exploiting popular messaging apps and the creation of deepfake videos. North Korea has long been accused by the U.S. of using cyber tactics to raise money for its government, including for its black budgeted arms programme.

Why it matters

The first is the scale. An earlier statement by the FBI said the stolen $1.5 billion from an exchange called Bybit in February 2025, attributed to North Korea, was the most common prior case. The number in Binance is over four times the same.

The second one is the approach. The FaceStealer description refers to attacks against individuals via messaging apps and synthetic video, not against cryptographic systems. Security in an exchange, that is, is as much dependant on staff and users as it is on code.

The third one is the process. A seizure order does not actually seize assets, it only freezes them. The process of forfeiture will establish who and in what order is repaid, and who is claiming will have to make their case.

What remains unknown

No details of how the money was withdrawn, or how customers' balances are being impacted, or how the amount has been traced, were provided by the reports. The details of Binance's own account of the seizure were not available. The remaining $1.2 billion is frozen under court orders, and additional legal action might be required for the remainder.

One seizure reveals that some of the stolen money is accessible to U.S. courts. The question of whether it will be delivered to those who have lost it will be left to forfeiture proceedings.