Key takeaways

• The U.S. Department of Justice obtained court authorization to seize or restrain more than $1.2 billion in crypto stolen from Binance.
• The funds are part of more than $2.7 billion frozen by U.S. authorities and private companies after the Oct. 29 hack, which the FBI attributes to North Korea.
• The DOJ also seized cloud infrastructure behind FaceStealer, a deepfake video-call scheme linked to more than $400 million in crypto thefts.

The U.S. Department of Justice has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, the department said on Thursday. It blamed the Oct. 29 theft on North Korean military hackers that the FBI calls “TraderTraitor.”

The $1.2 billion is part of more than $2.7 billion frozen through the work of U.S. authorities and private companies, the DOJ said. The hackers stole more than $6 billion in virtual assets from the exchange, and investigators are still tracing funds as they move through crypto bridges, mixers and exchanges.

“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, principal deputy assistant attorney general for national security. “The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.”

Assistant Attorney General A. Tysen Duva, who leads the Criminal Division, said its computer crime section and law enforcement partners froze stolen Binance assets “before they got beyond law enforcement reach.” He said the division moved to “immediately halt about half of this historic breach.”

“The North Korean regime may think they are sophisticated cyber criminals, but we have consistently met them head on, as we did here seizing more than $1.2 billion of their stolen assets,” said Jeanine Ferris Pirro, U.S. Attorney for the District of Columbia.

Binance previously put its losses at about $6.3 billion and set aside $6.34 billion in company funds to cover them, The Block reported. On Thursday, Binance said it had completed coverage of the affected assets and published a new proof-of-reserves snapshot, according to the same report.

FaceStealer Deepfake Scheme Disrupted

In a separate action, the U.S. Attorney’s Office for the Central District of California and the FBI disrupted cloud-based infrastructure used in a North Korean campaign the FBI calls “FaceStealer.” The scheme has led to the theft of more than $400 million in crypto over the past 18 months, the DOJ said.

The hackers hijack accounts and invite targets to fake video meetings that resemble Zoom or Microsoft Teams calls, CoinDesk reported. They play recorded webcam footage of earlier victims or AI-generated deepfakes, claim a technical problem, and tell the target to install a “fix” that is actually malware able to steal crypto.

Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims. The DOJ said the hackers increasingly target people who develop and maintain open-source software, which appears aimed at enabling supply-chain attacks. In some cases, thefts and account takeovers came months to more than a year after the first compromise.

“It exploits our trust in ubiquitous video conference platforms and valued personal relationships,” said Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office, according to The Block. CoinReporter earlier covered how stablecoin issuers and partners froze billions after the hack. The DOJ said investigators are still tracing the rest of the stolen assets.