DOJ moves to seize $1.2B from Binance hack, disrupts FaceStealer scam

The US Department of Justice announced Thursday it had secured court authorization to seize or restrain more than $1.2 billion of the $6.3 billion in cryptocurrency stolen from Binance. This action represents part of the $2.7 billion in stolen assets that US authorities and private-sector partners have frozen since the October 29 hack. Investigators continue working to recover additional funds, according to the department's announcement.

North Korean Connection

The FBI attributed the Binance hack to North Korea's TraderTraitor group in a cyber alert. However, Kim Yo Jong, sister of North Korean leader Kim Jong Un, denied her country's involvement. Binance confirmed it had covered the affected assets with its own funds and released a new proof-of-reserves snapshot showing at least one-to-one backing for customer assets.

FaceStealer Campaign

In a separate case, US authorities seized cloud infrastructure used in FaceStealer, a North Korean social engineering campaign that stole over $400 million in cryptocurrency over the past 18 months. The hackers used secretly recorded footage and AI-generated deepfakes of prominent crypto figures to gain targets' trust on video calls, then tricked them into installing malware through bogus technical fixes.

The campaign targeted people working in crypto and Web3, with hackers increasingly targeting open-source software developers and maintainers.

FBI Response

The FBI seized more than 900 webcam videos of FaceStealer victims under a federal warrant and published guidance on protecting against the scheme. The DOJ identified the hackers behind FaceStealer by several names, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.