US court lets DOJ seize $1.2 billion of the $6.3 billion stolen from Binance in crypto's biggest heist
The Justice Department's order is the first hard number in the record Binance heist, and the only one in the fight between TRM Labs and Chainalysis that neither vendor can shape. Most of the frozen money was stopped by the stablecoin issuers Tether and Circle, and Circle is the only listed stock in that chain.
Richard Tangthree-minute read
A US court has authorized the Justice Department to seize or restrain more than $1.2 billion of the cryptocurrency stolen from Binance on October 29, the largest theft in crypto's history 12. US authorities and private partners have frozen more than $2.7 billion of the $6.3 billion haul, which the FBI attributes to a North Korean group it calls TraderTraitor 12. The order matters beyond its size: it is the first figure in this recovery that neither of the analytics firms claiming credit can shape.
The freeze switch did the work, not the tracing
TRM Labs says the attackers took control of Binance's transaction-signing infrastructure, the machinery that authorizes transfers, instead of stealing wallet keys 1. Much of the haul sat in Tether's USDT and Circle's−3.79% — Circle, down 3.79 percent today USDC, dollar tokens whose issuers keep a blacklist inside the token contract; once an address lands on it, the coins cannot move anywhere the token is honored 3.
Tether says it froze more than $1.5 billion of USDT 3. Circle blacklisted the attackers' address 23 minutes after the stolen USDC reached it, working alongside the US Secret Service 45. Chainalysis watched the thieves convert $325 million of stablecoins into Ethereum in roughly 20 minutes to escape issuer reach, yet the first freezes began within hours 1.
Of the $6.3 billion stolen from Binance, $2.7 billion is frozen and $1.2 billion under court order
The court order is the only recovery figure no vendor can shape
Data
| Value | |
|---|---|
| Stolen on 29 Oct | $6.3B |
| Frozen by partners | $2.7B |
| Under US court order | $1.2B |
The vendors are selling numbers nobody audits
TRM announced its Beacon Concierge freeze desk on November 12: 15 cases for 14 agencies in 10 countries, more than $35 million frozen, on a network it says interdicted over $200 million and covers 80 percent of trading volume 67. Chainalysis claims $34 billion of lifetime freezes for authorities 8. The figures use different methods and nobody outside the companies checks them 8.
Behind them sits a contract fight: Tether and Tron wound down the T3 crime unit they built with TRM in August, two months before the theft, and rebuilt the same idea with Chainalysis this week; Chainalysis has also sued the US government over an ICE contract awarded to TRM, as we reported 910.
Circle is the listed name the market misread
Circle, the only listed company in the recovery chain, fell 9 percent in the first session after the hack, amid a wider crypto selloff, even as it froze the coins 5. Binance has set aside more than the stolen amount to repay users, so the open exposure is the rest of the haul, much of it in assets no issuer can switch off 34.
About two-fifths is frozen. Under a fifth sits under court order, and that gap is the real loss-given-a-hack once rescue funds are counted 1. The pressure is compounding on the other side too: the DOJ separately seized the infrastructure behind FaceStealer, a deepfake video-call scheme that took more than $400 million from crypto workers 11.
The vendors found the money. The issuers stopped it. Only a court can take it, and that is the scoreboard to follow.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
Reader comments
0 comments