North Korea Cryptocurrency Theft: DOJ Seizes Binance Assets - The Cryptonomist
The US Department of Justice has seized over $1.2 billion in stolen Binance assets and disrupted FaceStealer, a North Korean cryptocurrency theft operation that has stolen more than $400 million through fake video calls.
The US Department of Justice has moved against North Korea's cryptocurrency theft operations, seizing infrastructure behind fake video calls linked to more than $400 million in losses and obtaining court authorization to seize or restrain more than $1.2 billion stolen from Binance. The coordinated actions target two separate campaigns: the FaceStealer social engineering scheme and a multibillion-dollar exchange theft attributed to North Korean military hackers.
FaceStealer Operation
FaceStealer has stolen more than $400 million over 18 months, according to the FBI. Authorities seized cloud infrastructure and over 900 victim webcam recordings as part of their disruption efforts. The campaign uses recorded footage, deepfakes and fabricated technical problems to persuade targets to install malware.
Invitations arrive through fake or hijacked accounts, including accounts taken from earlier victims. Authorities say attackers use imitation versions of Zoom, Microsoft Teams and Google Meet, playing recordings of people the target knows to make the meeting appear legitimate. They also use deepfake videos of influential figures.
It exploits our trust in ubiquitous video conference platforms and valued personal relationships.
The attackers then claim that something is wrong—for example, that the target's microphone is not working—and offer a link or prompt to repair it. The supposed fix installs malware, giving hackers access to cryptocurrency, communications accounts and other computer infrastructure.
Binance Theft
North Korean military members identified by the FBI as TraderTraitor stole more than $6 billion in virtual assets from Binance on or about October 29, the Justice Department said. This theft was separate from FaceStealer. Binance said hackers used fake job interviews in the attack.
US government agencies and private-sector partners have frozen more than $2.7 billion connected to the Binance theft. Justice Department teams worked with virtual asset service providers to intercept the funds. Authorities continue tracing stolen assets through cryptocurrency bridges, mixers and exchanges.
The FBI, US Secret Service and Internal Revenue Service issued a Cyber Alert urging providers to block transactions involving, or derived from, addresses used to launder the Binance assets. The FBI also published a FaceStealer report and created a resource website.
Related
