DOJ gets court authority to seize $1.2 billion of Binance hack crypto, disrupts FaceStealer

The U.S. Department of Justice said on Nov. 12 that it obtained court authorization to seize or restrain more than $1.2 billion of the cryptocurrency stolen from Binance, and that federal agents disrupted cloud infrastructure behind "FaceStealer," a North Korean social engineering campaign tied to more than $400 million in theft over 18 months.

The actions announced by the department cover two separate efforts. One targets proceeds of the Oct. 29 theft at Binance, which the FBI attributes to North Korea's TraderTraitor group. The other takes down servers used in FaceStealer, in which hackers use recorded webcam footage and deepfakes to trick victims into installing malware during video calls.

On or about Oct. 29, members of the North Korean military referred to by the FBI as TraderTraitor stole more than $6 billion in virtual assets from Binance, the department said. U.S. agencies and private-sector partners have since frozen more than $2.7 billion, and the $1.2 billion court authorization sits inside that frozen total. Investigators are still tracing funds that continue to move through bridges, mixers and exchanges.

"Today's announcement shows that America will fight back against that corrupt regime's effort to profit through cybercrime," said Principal Deputy Assistant Attorney General for National Security M. Scott Proctor. "The National Security Division will use every tool at its disposal to seize and return North Korea's ill-gotten gains."

Assistant Attorney General A. Tysen Duva of the Criminal Division said partners "immediately froze billions of dollars' worth of stolen Binance digital assets before they got beyond law enforcement reach," and called that halt "about half of this historic breach." U.S. Attorney Jeanine Ferris Pirro for the District of Columbia said the seizure took more than $1.2 billion of stolen assets.

Cointelegraph reported that the FBI put out a cyber alert attributing the Binance hack to TraderTraitor, and that Binance said it covered affected assets with its own funds. Unchained noted that Elliptic had said some stolen crypto was routed through homemade meme coins.

In the FaceStealer case, prosecutors in the Central District of California said hackers lured targets to video meetings from accounts taken from earlier victims, then played prerecorded clips of people the target knew. A staged glitch, such as a claim the target cannot be heard, led to a "fix" that installed malware. The department said the group also used what it called super intelligence to build deepfakes of public figures in crypto and Web3.

The FBI seized more than 900 webcam videos of victims under a federal warrant and published a report and resource page on the scheme. The department said hackers increasingly target open-source software developers and maintainers, including a case where the maintainer of a widely used JavaScript library was infected through a fake Microsoft Teams call.

North Korean actors known as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima are linked to the campaign, the department said. The FBI said FaceStealer has stolen more than $400 million in the past 18 months.

First Assistant U.S. Attorney Bill Essayli for the Central District of California called the seizure a fight "against rogue states who financially gain from cybercrime." FBI Cyber Branch Operations Director Brett Leatherman said North Korean actors used FaceStealer against people in the cryptocurrency and Web3 sectors, resulting in theft of more than $400 million in 18 months.

The Binance freeze work involved the National Security Division's National Security Cyber Section, the Criminal Division's Computer Crime and Intellectual Property Section, the U.S. Attorney's Office for the District of Columbia and virtual asset service providers, according to the department. Efforts to trace, freeze, seize and forfeit the assets are ongoing as TraderTraitor actors continue laundering through bridges, mixers and exchanges.