DOJ Moves to Seize $1.2B From Binance Hack, Disrupts North Korean Crypto Scam

The US Department of Justice has obtained court authorization to seize or restrain more than $1.2 billion in crypto stolen from Binance in October. The announcement on November 12 came alongside a separate operation to disrupt FaceStealer, a North Korean-linked social engineering campaign that has stolen more than $400 million in crypto over the past 18 months.

The Binance funds are part of more than $2.7 billion in stolen assets frozen through cooperation between US authorities and private-sector companies. The FBI attributed the October 29 attack, which resulted in approximately $6.3 billion in losses, to North Korean military hackers known as TraderTraitor. Investigators are continuing to trace the remaining funds, which the attackers have been moving through crypto bridges, mixers, and exchanges.

In the separate FaceStealer operation, authorities seized cloud infrastructure used by the hackers. The campaign targeted people working in cryptocurrency and Web3, as well as open-source software developers. Attackers sent invitations to video calls from accounts they had previously compromised, then played recordings of people familiar to their targets or AI-generated deepfakes of prominent industry figures.

During the calls, hackers staged technical problems and directed victims to fake fixes that secretly installed malware on their devices. The malware gave attackers access to crypto holdings, communications accounts, and contact lists, which they used to identify further targets. The FBI seized more than 900 webcam videos recorded during the campaign under a federal warrant.

The DOJ said the FaceStealer operation has also increasingly targeted open-source software maintainers, apparently seeking access to software repositories and opportunities for supply-chain attacks. The FBI has published an advisory explaining how the scheme works and how potential victims can protect themselves.