DOJ moves to seize $1.2 billion from Binance hack and disrupts North Korean FaceStealer scheme
Federal prosecutors secured court approval to seize or restrain over $1.2 billion in cryptocurrency stolen from Binance, while authorities dismantled infrastructure used in a North Korean video-call social engineering campaign called FaceStealer that took more than $400 million.
The U.S. Department of Justice announced court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from exchange Binance by North Korean military hackers known as TraderTraitor. The late October breach saw hackers take more than $6 billion in virtual assets, of which government and private-sector partners have now frozen more than $2.7 billion across stablecoin issuers and networks.[3][7][9][11][12]
Federal law enforcement also revealed an operation disrupting the cloud infrastructure behind FaceStealer, an 18-month social engineering campaign attributed to North Korean hacking groups such as Sapphire Sleet. According to the FBI and DOJ, FaceStealer generated over $400 million in stolen digital assets by targeting crypto, Web3, and open-source developers with counterfeit video conference calls on platforms including Zoom and Microsoft Teams.[1][5][8][9][11]
Investigators reported that attackers hijacked communications accounts on services like Telegram and LinkedIn to send fake meeting invitations, secretly recording targets' webcams upon initial link clicks and replaying stolen footage or deepfakes of trusted contacts. Mid-call, operatives staged technical glitches that prompted victims to install software fixes carrying malware. Under a federal warrant executed in Los Angeles, authorities seized more than 900 recorded webcam videos of victims.[4][6][8][9][10][11]
North Korea has denied responsibility for the Binance hack, with Kim Yo Jong dismissing the allegations as a grave political provocation designed to mislead international public opinion.[11]
Key facts
- A court authorized the DOJ to seize or restrain over $1.2 billion in cryptocurrency stolen from Binance by North Korean hackers.
- More than $6 billion was stolen from Binance on or about October 29, with public and private efforts freezing over $2.7 billion of the proceeds.
- The DOJ and FBI disrupted cloud infrastructure supporting FaceStealer, a North Korean campaign that stole over $400 million across 18 months.
- FaceStealer lured targets into fake video calls using hijacked accounts and replayed footage of trusted contacts, prompting malicious software updates.
- Federal agents seized more than 900 webcam recordings of victims collected during the FaceStealer scheme.
- North Korea rejected the accusations, with Kim Yo Jong calling the claims a grave political provocation.
Sources · 12 sources
- CB
Crypto Banter@crypto_banterPost on X ·
🚨DOJ SEIZES $1.2B IN NORTH KOREA-LINKED CRYPTO, FBI DISRUPTS FACESTEALER SCHEME! The Department of Justice has moved to seize more than $1.2 billion in cryptocurrency tied to North Korean hackers from the roughly $6.3 billion @binance theft in late October. Separately, the FBI and DOJ disrupted cloud infrastructure used in the FaceStealer deepfake video-call scheme, which stole more than $400 million over 18 months by targeting crypto and Web3 professionals with recorded webcam video and imposter links. The FBI attributes FaceStealer to North Korean groups including Sapphire Sleet.
Open source - TW
The Wolf Of All Streets@scottmelkerPost on X ·
🇺🇸 FBI SAYS NORTH KOREAN HACKERS STOLE MORE THAN $400M IN CRYPTO IN 18 MONTHS USING FAKE ZOOM AND TEAMS CALLS THE FBI SEIZED THE SCHEME'S SERVERS AND OVER 900 WEBCAM VIDEOS OF VICTIMS https://t.co/SfjBhH7RV6
Open source - QU
Quartz@qzPost on X ·
U.S. won court order to seize or restrain more than $1.2 billion in crypto stolen from Binance: U.S. and private-sector efforts have frozen more than $2.7 billion of the funds North Korean hackers took from the exchange dlvr.it/TWK91h https://t.co/gHqxv7Xatd
Open source - CR
CryptoSlate@CryptoSlatePost on X ·
North Korean hackers record crypto workers’ webcams from the first click on a fake meeting link, the @FBI warns. That is before any fake audio fix installs malware. The footage can later be used to impersonate them to their contacts. via @akibablade https://t.co/azlyd815Id
Open source - DE
DecryptArticle ·
North Korea Stole $400 Million in Crypto Using Deepfake Video Calls, DOJ Says The FBI says the “FaceStealer” scheme uses prerecorded footage and AI deepfakes of trusted contacts to trick crypto workers into installing malware on video calls—as the DOJ also moves to seize $1.2 billion from the Binance hack.
Open source - DN
DEGEN NEWS@DegenerateNewsPost on X ·
NEW: FBI SAYS NORTH KOREAN HACKERS HIJACK TELEGRAM AND LINKEDIN ACCOUNTS TO LURE CRYPTO AND WEB3 WORKERS INTO FAKE ZOOM AND TEAMS CALLS - SECRETLY RECORDING THEIR WEBCAMS "FACESTEALER" HAS STOLEN $400M+ FROM 900+ VICTIMS IN 18 MONTHS https://t.co/GdGjh4bSlN
Open source - TE
TechmemeArticle ·
The DOJ says it got court authorization to seize or restrain $1.2B of the $2.7B frozen by Tether and Circle after North Korea's $6.3B Binance hack on October 29 (Myles Miller/Bloomberg) Myles Miller / Bloomberg : The DOJ says it got court authorization to seize or restrain $1.2B of the $2.7B frozen by Tether and Circle after North Korea's $6.3B Binance hack on October 29 — The Justice Department says it's joined with the two biggest stablecoin issuers in efforts to secure almost half the money stolen …
Open source - TM
That Martini Guy ₿@MartiniGuyYTPost on X ·
The FBI is warning the crypto industry about another North Korean hacking operation. A campaign called FaceStealer has reportedly stolen more than $400M in cryptocurrency over the past 18 months. The attackers use compromised contacts to invite victims to fake Zoom, Teams and Google Meet calls. They then play recordings or deepfakes of people the victims trust, introduce a fake technical problem and trick them into installing malware. The FBI says it has seized more than 900 webcam videos. This is a reminder that security threats aren't just coming through wallets and smart contracts anymore.
Open source - UN
UnchainedArticle ·
Court Order Lets DOJ Lock Up $1.2 Billion of North Korea’s Stolen Binance Crypto The U.S. Department of Justice (DOJ) has court authorization to seize or restrain more than $1.2 billion of the crypto North Korean hackers took from Binance , the department said Thursday . The same release laid out an FBI operation against “FaceStealer,” a scheme in which hackers use stolen webcam footage to fake trusted faces on video calls. Members of North Korea’s military, a unit the FBI calls TraderTraitor , stole more than $6 billion in virtual assets from the exchange on or about Oct. 29, the DOJ said in the release. Government and private-sector efforts have since frozen more than $2.7 billion, and the $1.2 billion sits inside that frozen total. Assistant Attorney General A. Tysen Duva said in a statement that the Criminal Division moved to “immediately halt about half of this historic breach.” Days after the hack, Pablo Sabbatella, founder of security firm Opsek, said on Unchained that in most hacks, “They hack you once and most of the funds are gone.” This time, he said, “the industry was quite fast” at freezing what it could. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . The Laundering Continues The department said the hackers are still moving funds through bridges, mixers and exchanges. On Oct. 31, the FBI, the Secret Service and IRS Criminal Investigation put out an alert that blamed North Korea for the theft and asked virtual asset service providers, the exchanges and other firms that handle crypto for customers, to block transactions linked to TraderTraitor addresses. Blockchain analytics firm Elliptic said on Monday that some of the stolen crypto was being routed through homemade meme coins. The National Security Division “will use every tool at its disposal to seize and return North Korea’s ill-gotten gains,” said M. Scott Proctor, its principal deputy assistant attorney general. How FaceStealer Works In a separate action, federal prosecutors in Los Angeles said they disrupted the cloud infrastructure behind FaceStealer, which the FBI links to more than $400 million in theft over the past 18 months. Agents also seized over 900 webcam videos of victims under a federal warrant. The DOJ said the hackers send meeting invites from accounts hijacked from earlier victims, then play recorded clips of people the target already knows. Midway through, a staged glitch, such as a claim the target can’t be heard, leads to a “fix” that installs malware. The department said the group has also used what it called “super intelligence” to make deepfakes of public figures in crypto, though the FBI’s technical report says the scheme still relies “overwhelmingly” on real stolen footage. Open-source developers are a growing target. The FBI said that earlier this year the maintainer of a widely used JavaScript library was infected through a fake Microsoft Teams call, and the attack was caught before it spread. Related Listen: How North Korea’s Launderers Try to Shake Off Blockchain Analytics The post Court Order Lets DOJ Lock Up $1.2 Billion of North Korea’s Stolen Binance Crypto appeared first on Unchained .
Open source - MN
Mario Nawfal@MarioNawfalPost on X ·
🇰🇵 The FBI says North Korean hackers STOLE over $400M in crypto using recorded webcam videos in fake video calls. They hijacked Telegram, LinkedIn, and Slack accounts, using footage of trusted contacts to make Zoom and Teams calls look real. Once targets joined, hackers faked tech issues and tricked them into installing malware to steal wallets and credentials. The FBI seized over 900 victim videos. The same groups carried out the $6.3B Binance heist. Source: Reuters / Writer: Lucas
Open source - PR
ProtosArticle ·
US seizes $1.2 billion frozen after North Korean Binance hack The US Department of Justice (DoJ) yesterday announced the seizure of $1.2 billion in cryptocurrency stolen from Binance last month by hackers linked to North Korea. It was also revealed that $400 million in crypto has been stolen by North Korea as part of a separate “FaceStealer” social engineering scheme. Operatives were said to be luring victims into remote meetings made up of pre-recorded footage of past victims and AI-generated individuals. As part of the scam, something goes wrong in the meeting and the victim is encouraged to download a “fix” that contains malware that steals their crypto. To counter the scheme, the US seized cloud-based infrastructure and 900 webcam videos of FaceStealer victims. US seized already frozen funds The billion-dollar seizure makes up a portion of $2.7 billion worth of stolen funds that were frozen by crypto firms Tether, Ripple, Circle, World Liberty Financial, and Arbitrum. Over $6 billion was stolen from Binance overall. Techniques similar to those used in the FaceStealer campaign may have been employed when hackers used fake job interviews to deliver malware to unsuspecting Binance employees. Binance faces renewed scrutiny as CFO exits amid compliance turmoil Read more: How the Binance hack happened on-chain on Ethereum Today’s DoJ report also highlighted how hackers are using crypto bridges, mixers, and exchanges to launder funds. It noted a previous cyber alert that urged node operators associated with THORChain to block transactions linked to TraderTraitor. One laundering method it didn’t mention was the use of cheap memecoins, some of which were themed around Elon Musk. North Korea says it wasn’t us! The US claims North Korea uses stolen funds to develop its “rogue regime and illicit weapons program,” and that the US action allowed it to freeze the funds before they “got beyond law enforcement reach. However, North Korea has denied any involvement in the hack and described the allegations as another “sinister attempt” from the US to damage its public image. Kim Jong Un’s sister, Kim Yo Jong, said, “It is a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds.” Got a tip? Send us an email securely via Protos Leaks . For more informed news and investigations, follow us on X , Bluesky , and Google News , or subscribe to our YouTube channel. The post US seizes $1.2 billion frozen after North Korean Binance hack appeared first on Protos .
Open source - DE
Decrypt@DecryptMediaPost on X ·
DOJ Moves to Seize $1.2B Stolen From Binance, Blames North Korean Military. The Justice Department said Thursday it has court authorization to seize or restrain more than $1.2 billion of the $2.7 billion-plus frozen so far, out of more than $6 billion stolen from Binance on Oct. 29.
Open source