US Works With Two Largest Stablecoin Issuers on $2.7B Binance Freeze
The US Justice Department says it joined with the two largest stablecoin issuers to secure about $2.7 billion, almost half the funds stolen from Binance. Frozen is not recovered, and Binance's reserve proof is still pending.
Almost half of the more than $6 billion taken from Binance is now frozen, and the US Justice Department says it got there by working with the two biggest stablecoin issuers. Bloomberg reported the department's account on Nov. 12, putting the freeze at $2.7 billion and attributing the attack to North Korea.
The cooperation with stablecoin issuers is what moves the story beyond our earlier report on the department's seizure effort. The initial report did not name the two issuers, describe how the freezes were carried out, or break the $2.7 billion down by token.
The news arrived the same day Binance said it had finished making customers whole. As laid out in our earlier coverage, the exchange covered the $6.34 billion loss from company funds.
Attribution to North Korea
Hackers drained Binance wallets on Oct. 29. The FBI later blamed TraderTraitor, a North Korean hacking unit, and asked exchanges to block wallets tied to the theft. Accounts of the attack trace its start to a fake job interview and a poisoned developer tool. Binance's own announcement does not name an attacker.
Two freeze figures, one caveat
The numbers do not line up neatly. Chainalysis data put the frozen amount at about $2.8 billion as of Nov. 3, while the Justice Department figure is $2.7 billion. The amounts and dates differ, and nothing published so far reconciles them.
The more important distinction is between frozen and recovered. A freeze works less like a refund and more like a lock on a safe deposit box: the tokens stop moving, but nobody gets them back until some further step releases them. Binance's announcement does not say how much of the stolen assets has been retrieved, and its "coverage" means it replaced the affected tokens from its own books rather than clawing back the attackers' haul.
Binance repeated its coverage announcement in a post on X.
Yi He framed the next milestone as independent verification:
"Binance has completed coverage of assets impacted in the security incident and we have published a new Proof of Reserves snapshot. Once the zero-knowledge proof is generated, users can independently verify that their assets are backed at a minimum of 1:1."
Yi He, Binance
That verification is still pending. The new proof-of-reserves snapshot covers 198 tokens, and its zero-knowledge proof will take about 40 to 50 hours to generate; until it is published, users cannot check 1:1 backing for themselves. Withdrawals, which began reopening on Nov. 1 starting with bitcoin, remain phased.
What it means
Scale explains the stakes. At $6.34 billion, the theft is roughly four times the $1.5 billion Bybit hack in 2025, which makes a freeze of nearly half the haul significant on its own terms. Binance, for its part, has committed to replenishing its SAFU emergency fund to about $1 billion after a partial draw.
What happens to the frozen portion next is the open question, and the reports so far do not say.
