CoinDesk
The U.S. Department of Justice has received court authority to seize more than $1.2 billion in cryptocurrency stolen in the October 29 attack on Binance, which the FBI attributes to the North Korea-linked hacking operation known as TraderTraitor. The authorized seizure is part of a broader effort by U.S. authorities and private companies that has frozen more than $2.7 billion of the more than $6 billion taken in the heist.
In a separate operation, federal agents seized cloud infrastructure used in the FaceStealer campaign, which the FBI says has stolen more than $400 million in cryptocurrency over the past 18 months. That scheme uses fake video meetings resembling Zoom or Microsoft Teams calls, complete with recorded webcam footage and AI-generated deepfakes of trusted contacts, to trick victims into installing malware. The FBI seized more than 900 webcam videos collected by the attackers.
Why it matters
North Korea funds its weapons program largely through crypto theft, and the DOJ is now moving from naming and shaming to actively clawing back assets. "America will fight back against that corrupt regime's effort to profit through cybercrime," said M. Scott Proctor, principal deputy assistant attorney general for national security. The National Security Division says it will use every tool at its disposal to seize and return the stolen funds.
Market impact
Investigators are continuing to trace stolen funds moving through blockchain bridges, mixers and exchanges, seeking to freeze and recover more of what was taken. With $2.7 billion already frozen out of more than $6 billion stolen, public-private cooperation is proving to be the decisive lever. Operators and developers should note the FBI's warning that FaceStealer has also targeted maintainers of widely used open-source software, a supply-chain risk with market-wide reach.
Frequently asked questions
-
How much crypto did North Korea steal from Binance?
The DOJ says more than $6 billion was stolen from Binance on October 29 in an attack the FBI attributes to the North Korea-linked TraderTraitor operation.
-
How much of the stolen Binance funds has been frozen or recovered?
A broader effort by U.S. authorities and private companies has frozen more than $2.7 billion of the stolen funds, and the DOJ has received court authority to seize over $1.2 billion of that.
-
What is the FaceStealer scheme?
FaceStealer is a North Korean hacking campaign that has stolen more than $400 million in crypto over 18 months by luring victims into fake Zoom or Teams-style meetings and tricking them into installing malware.
-
How do the FaceStealer hackers trick their targets?
They impersonate trusted contacts using secretly recorded webcam footage from previous victims and AI-generated deepfakes, then instruct the target to run software that installs malware during the fake meeting.
-
How are investigators recovering the stolen cryptocurrency?
Investigators are tracing stolen funds moving through blockchain bridges, mixers and exchanges, working to freeze and recover more of the assets, according to the DOJ.
WatcherGuru
TheBlock
CoinTelegraph
WuBlockchain
Lookonchain