Department Of Justice Seizes $1.2B In North Korean Crypto Stolen From Binance - TronWeekly
The U.S. Department of Justice has seized $1.2 billion in cryptocurrency stolen from Binance by North Korean military hackers, part of a $6.3 billion cyberattack attributed to the group TraderTraitor.
The U.S. Department of Justice has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance by North Korean military hackers. The action represents nearly half of the $2.7 billion in stolen cryptocurrency frozen by the U.S. government and its partners since the October 29 cyberattack.
The FBI attributed the massive Binance hack to a group known as TraderTraitor, which operates under the direction of the Democratic People's Republic of Korea (DPRK). The DOJ aims to freeze the stolen funds related to the $6.3 billion cyberattack as part of a broader strategy to interfere with cryptocurrency-theft operations.
Criminal Division and its colleagues acted fast to stop about half of the huge Binance hack.
TraderTraitor Moves Stolen Assets
The FBI reported that military members of the DPRK conducted the Binance attack using the alias 'TraderTraitor.' The attackers transferred stolen assets to accounts where the funds were being converted to Ether (ETH), utilizing decentralized finance (DeFi) applications and instant swap services to complicate tracing efforts.
The FBI has appealed to cryptocurrency exchanges, DeFi services, blockchain intelligence firms, and infrastructure providers to block transactions connected to specific wallet addresses released by authorities. Investigations continue as North Korean hackers attempt to move remaining stolen funds through cryptocurrency bridges, mixers, and exchanges.
FaceStealer Uses Deepfakes
Alongside the Binance action, the DOJ announced the seizure of cloud-based infrastructure used in another North Korean scheme called FaceStealer. This operation has stolen over $400 million in cryptocurrency over 18 months through sophisticated deepfake technology.
The hackers compromised accounts of people in cryptocurrency, Web3, and open-source software development by arranging video meetings using pre-recorded footage and AI-generated videos to impersonate influential figures. They would then introduce false technical issues, prompting victims to install malware that gave access to cryptocurrency and other sensitive information.
The operation could deceive even technical experts by using trustful contacts and reliable videoconferencing tools.
The FBI seized over 900 webcam recordings and disrupted the cloud computing resources used in the campaign. The FaceStealer operation specifically targeted open-source software developers to facilitate supply-chain attacks on other organizations' applications, extending the threat beyond cryptocurrency holders.
Broader Implications
The DOJ claims that the DPRK uses cryptocurrency theft as a means to generate money for funding its government and illicit weaponry. The enforcement action involved multiple agencies including the National Security Division, Criminal Division, FBI, U.S. Secret Service, and IRS Criminal Investigation.
For cryptocurrency businesses, these developments reinforce the importance of verifying meeting invitations through separate channels, avoiding unfamiliar software installation prompts, and implementing wallet monitoring with rapid response protocols to law enforcement notifications. Investigations into both TraderTraitor and FaceStealer operations remain ongoing.
Related
