US seizes over $1.2B of crypto stolen from Binance in North Korea-linked hack

U.S. authorities seized and restrained more than $1.2 billion worth of cryptocurrency recently stolen from Binance, the Department of Justice said Thursday. The DOJ tied the attack to actors linked to the North Korean military. More than $6 billion was lifted from the exchange on Oct. 29, and collective work between the government and the private sector has frozen over $2.7 billion of that total.

The FBI blames the heist, which rattled confidence in crypto market security, on North Korean military members it refers to as "TraderTraitor." DOJ units, law enforcement partners and virtual asset service providers have been scrambling to intercept the stolen assets. But the chase isn't over: the DOJ said TraderTraitor actors keep laundering the funds through various cryptocurrency channels.

Separately, authorities seized cloud-based infrastructure used in a massive identity impersonation scam known as "FaceStealer," which has drained more than $400 million in crypto over 18 months. Hackers set up fake video meetings using stolen accounts and recordings of people the target knows, built with AI-generated deepfakes, then claim a technical problem needs fixing. That gets malware onto the victim's machine, hands over their communications and their crypto — and the hackers come back for their contacts, sometimes months or more than a year later. People working in crypto and web3 are prime targets.

Patrick Grandy, Assistant Director in Charge of the FBI's Los Angeles Field Office, called FaceStealer "a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user." He added that it "exploits our trust in ubiquitous video conference platforms and valued personal relationships," warning: "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."

M. Scott Proctor, Principal Deputy Assistant Attorney General for National Security, framed the seizures as a direct hit on Pyongyang's funding. "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," he said in a statement. "America will fight back against that corrupt regime's effort to profit through cybercrime. The National Security Division will use every tool at its disposal to seize and return North Korea's ill-gotten gains."