More than $2.7 billion was frozen after Binance’s breach. That is not the same as recovery

The Justice Department said Thursday that combined government and private-sector efforts froze more than $2.7 billion stolen from Binance and that courts authorized DOJ to seize or restrain more than $1.2 billion of that frozen amount. The department said efforts to trace, freeze, seize and forfeit the stolen assets are continuing.

Binance put the value affected by the October 29 breach above $6.34 billion. Using that company figure as the denominator, the published frozen total is about 42.6% and the amount covered by seizure-or-restraint authority is about 18.9%. Those are approximate comparisons, not recovered-share figures: each published total is qualified, and cryptocurrency values can move.

A freeze can stop an asset from moving without placing it in government custody. Court authorization to seize or restrain does not establish that every covered asset has been transferred, forfeited through a final judgment or returned to an owner. DOJ did not disclose the split between seizure and restraint, and its announcement says forfeiture work remains ongoing.

That legal progress does not answer the central accountability question: how did attackers obtain enough effective authority inside Binance’s operational environment to move more than $6 billion, and do the company’s repairs address the final cause? North Korea’s responsibility for the theft, as attributed by the FBI and DOJ, does not replace scrutiny of the exchange’s controls.

Binance’s November 3 account described unauthorized access to an internal wallet-signing service and a multi-stage campaign involving compromised employee devices, malicious software and social engineering. It said identified entry points were closed, affected systems were rebuilt or replaced and device and wallet-service controls were tightened. The company also said it had found no evidence of a wallet private-key leak.

But Binance called that report initial. It said the investigation remained ongoing, that its findings would undergo further independent review and that outside security firms were being engaged. Binance has not published a final root-cause report or the findings of that outside review, leaving the public unable to test whether the disclosed repairs match the ultimate failure.

The company has taken significant steps that cut against claims of an uncovered customer hole. Binance apologized, said users would not absorb the loss and reported committing more than $6.34 billion in company-controlled resources from SAFU, its futures insurance fund and corporate treasury to cover affected assets. It also committed to restore SAFU to about $1 billion and said withdrawals were reopening in phases.

Binance also published a November 12 proof-of-reserves snapshot covering 198 tokens. At the time of its announcement, the full zero-knowledge proof was still expected to take 40 to 50 hours to generate. That snapshot addresses Binance’s stated asset-coverage position; it is not proof that stolen property was recovered, a conventional audit of every company liability or the promised final incident review.

The public record therefore shows two kinds of progress and two remaining gaps. Binance says customers are covered from company resources, while law enforcement and private partners have immobilized part of the stolen pool. Neither step establishes final recovery of the money, and neither supplies the still-missing final explanation of the control failure that allowed the breach.