DOJ moves to seize $1.2 billion from Binance hack and dismantles FaceStealer scheme
The US Department of Justice has secured court approval to seize or restrain more than $1.2 billion in cryptocurrency stolen in the Binance breach, while federal authorities disrupted the North Korean FaceStealer video-call malware campaign.
The U.S. Department of Justice has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency taken during an alleged $6.3 billion hack of Binance on or about October 29, according to statements and filings reported by Unchained and Bloomberg. The $1.2 billion sits within a broader pool of more than $2.7 billion frozen through coordinated government and private-sector efforts alongside stablecoin issuers Tether and Circle.[9][4][5][14]
The DOJ attributes the breach to a North Korean military hacking cell the FBI designates TraderTraitor. Assistant Attorney General A. Tysen Duva noted that the Criminal Division acted to halt approximately half of the historic theft, while Principal Deputy Assistant Attorney General M. Scott Proctor said the National Security Division would use every available tool to claw back illicit proceeds. Authorities stated the hackers continue attempting to launder funds across bridges, mixers, and exchanges, with blockchain analytics firm Elliptic observing assets routed through homemade meme coins.[9][10][6]
In a coordinated enforcement action, federal prosecutors in Los Angeles and the FBI disrupted cloud-based infrastructure powering "FaceStealer," an 18-month social engineering operation that stole more than $400 million in cryptocurrency. Under a federal warrant, investigators seized over 900 recorded victim webcam videos. The FBI revealed that attackers hijacked trusted accounts on platforms like LinkedIn, Telegram, and Slack to invite targets to fake Zoom and Teams meetings, playing stolen footage or deepfakes and staging fake technical glitches to trick victims into installing malware.[9][1][2][11][3]
Key facts
- A court authorized the DOJ to seize or restrain over $1.2 billion in cryptocurrency stolen from Binance during a breach totaling more than $6 billion on or about October 29.
- Government and industry efforts, including cooperation from stablecoin issuers Tether and Circle, have frozen more than $2.7 billion of the stolen Binance funds.
- The DOJ and FBI attribute the Binance breach to a North Korean military hacking unit designated TraderTraitor.
- Federal authorities in Los Angeles disrupted the cloud infrastructure behind FaceStealer, which stole more than $400 million over an 18-month span.
- The FBI seized more than 900 webcam recordings of victims collected during the FaceStealer operation.
- FaceStealer attackers hijacked accounts on Slack, Telegram, and LinkedIn, staging fake glitches on Zoom and Teams calls to prompt victims to install malware.
Sources · 14 sources
- CB
Crypto Banter@crypto_banterPost on X ·
🚨DOJ SEIZES $1.2B IN NORTH KOREA-LINKED CRYPTO, FBI DISRUPTS FACESTEALER SCHEME! The Department of Justice has moved to seize more than $1.2 billion in cryptocurrency tied to North Korean hackers from the roughly $6.3 billion @binance theft in late October. Separately, the FBI and DOJ disrupted cloud infrastructure used in the FaceStealer deepfake video-call scheme, which stole more than $400 million over 18 months by targeting crypto and Web3 professionals with recorded webcam video and imposter links. The FBI attributes FaceStealer to North Korean groups including Sapphire Sleet.
Open source - TW
The Wolf Of All Streets@scottmelkerPost on X ·
🇺🇸 FBI SAYS NORTH KOREAN HACKERS STOLE MORE THAN $400M IN CRYPTO IN 18 MONTHS USING FAKE ZOOM AND TEAMS CALLS THE FBI SEIZED THE SCHEME'S SERVERS AND OVER 900 WEBCAM VIDEOS OF VICTIMS https://t.co/SfjBhH7RV6
Open source - DE
DecryptArticle ·
North Korea Stole $400 Million in Crypto Using Deepfake Video Calls, DOJ Says The FBI says the “FaceStealer” scheme uses prerecorded footage and AI deepfakes of trusted contacts to trick crypto workers into installing malware on video calls—as the DOJ also moves to seize $1.2 billion from the Binance hack.
Open source - TE
TechmemeArticle ·
The DOJ says it got court authorization to seize or restrain $1.2B of the $2.7B frozen by Tether and Circle after North Korea's $6.3B Binance hack on October 29 (Myles Miller/Bloomberg) Myles Miller / Bloomberg : The DOJ says it got court authorization to seize or restrain $1.2B of the $2.7B frozen by Tether and Circle after North Korea's $6.3B Binance hack on October 29 — The Justice Department says it's joined with the two biggest stablecoin issuers in efforts to secure almost half the money stolen …
Open source - TE
Techmeme@TechmemePost on X ·
The DOJ says it got court authorization to seize or restrain $1.2B of the $2.7B frozen by Tether and Circle after North Korea's $6.3B Binance hack on October 29 (@mylesmill / Bloomberg) (Visit Techmeme dot com for the link and full context!)
Open source - TB
The BlockArticle ·
DOJ moves to seize $1.2 billion from Binance hack, disrupts North Korean deepfake scheme DOJ got court approval to seize $1.2B stolen from Binance by North Korea's TraderTraitor & took down the FaceStealer deepfake scam.
Open source - SO
SolanaFloor@SolanaFloorPost on X ·
🚨JUST IN: 🇺🇸US DOJ says North Korean hackers stole over $400M in crypto in 18 months through FaceStealer, using deepfake video calls to impersonate trusted contacts and trick victims into installing malware via fake technical fixes. https://t.co/CjmIkAfscz
Open source - AI
Analytics Insight@analyticsinmePost on X ·
𝐅𝐁𝐈 𝐃𝐢𝐬𝐫𝐮𝐩𝐭𝐬 𝐍𝐨𝐫𝐭𝐡 𝐊𝐨𝐫𝐞𝐚𝐧 𝐅𝐚𝐜𝐞𝐒𝐭𝐞𝐚𝐥𝐞𝐫 𝐂𝐫𝐲𝐩𝐭𝐨 𝐇𝐚𝐜𝐤 𝐋𝐢𝐧𝐤𝐞𝐝 𝐭𝐨 𝐔𝐒𝐃 𝟒𝟎𝟎 𝐌𝐢𝐥𝐥𝐢𝐨𝐧 𝐓𝐡𝐞𝐟𝐭 FBI Disrupts North Korean FaceStealer Crypto Hack Linked to USD 400 Million Theft! The FBI has disrupted a sophisticated North Korea-linked hacking campaign that allegedly stole over USD 400 million in cryptocurrency through fake video calls impersonating trusted contacts. Authorities seized infrastructure and more than 900 victim recordings, while cybersecurity researchers identified over 677 targets across 58 countries. Separately, the US Justice Department authorized the seizure or restraint of USD 1.2 billion linked to Binance's reported USD 6.3 billion hack, with over USD 2.7 billion already frozen. Can cryptocurrency companies protect users against increasingly sophisticated social engineering attacks? #NorthKoreanHackers #FaceStealer #FBI #CryptoHack #Cryptocurrency #BinanceHack #Cybersecurity #CryptoSecurity #CryptoTheft #analyticsinsight #analyticsinsightmagazine Read More 👇 https://t.co/uSOT0bKbjY
Open source - UN
UnchainedArticle ·
Court Order Lets DOJ Lock Up $1.2 Billion of North Korea’s Stolen Binance Crypto The U.S. Department of Justice (DOJ) has court authorization to seize or restrain more than $1.2 billion of the crypto North Korean hackers took from Binance , the department said Thursday . The same release laid out an FBI operation against “FaceStealer,” a scheme in which hackers use stolen webcam footage to fake trusted faces on video calls. Members of North Korea’s military, a unit the FBI calls TraderTraitor , stole more than $6 billion in virtual assets from the exchange on or about Oct. 29, the DOJ said in the release. Government and private-sector efforts have since frozen more than $2.7 billion, and the $1.2 billion sits inside that frozen total. Assistant Attorney General A. Tysen Duva said in a statement that the Criminal Division moved to “immediately halt about half of this historic breach.” Days after the hack, Pablo Sabbatella, founder of security firm Opsek, said on Unchained that in most hacks, “They hack you once and most of the funds are gone.” This time, he said, “the industry was quite fast” at freezing what it could. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . The Laundering Continues The department said the hackers are still moving funds through bridges, mixers and exchanges. On Oct. 31, the FBI, the Secret Service and IRS Criminal Investigation put out an alert that blamed North Korea for the theft and asked virtual asset service providers, the exchanges and other firms that handle crypto for customers, to block transactions linked to TraderTraitor addresses. Blockchain analytics firm Elliptic said on Monday that some of the stolen crypto was being routed through homemade meme coins. The National Security Division “will use every tool at its disposal to seize and return North Korea’s ill-gotten gains,” said M. Scott Proctor, its principal deputy assistant attorney general. How FaceStealer Works In a separate action, federal prosecutors in Los Angeles said they disrupted the cloud infrastructure behind FaceStealer, which the FBI links to more than $400 million in theft over the past 18 months. Agents also seized over 900 webcam videos of victims under a federal warrant. The DOJ said the hackers send meeting invites from accounts hijacked from earlier victims, then play recorded clips of people the target already knows. Midway through, a staged glitch, such as a claim the target can’t be heard, leads to a “fix” that installs malware. The department said the group has also used what it called “super intelligence” to make deepfakes of public figures in crypto, though the FBI’s technical report says the scheme still relies “overwhelmingly” on real stolen footage. Open-source developers are a growing target. The FBI said that earlier this year the maintainer of a widely used JavaScript library was infected through a fake Microsoft Teams call, and the attack was caught before it spread. Related Listen: How North Korea’s Launderers Try to Shake Off Blockchain Analytics The post Court Order Lets DOJ Lock Up $1.2 Billion of North Korea’s Stolen Binance Crypto appeared first on Unchained .
Open source - TB
The Block@TheBlockCoPost on X ·
THE BLOCK: The U.S. Justice Department said it has seized $1.2 billion of digital assets connected to the $6 billion Binance hack, as part of an effort to block the North Korean government's alleged scheme to fund itself through crypto. "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," said Principal Deputy Assistant Attorney General for National Security M. Scott Proctor. "Today's announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime."
Open source - MN
Mario Nawfal@MarioNawfalPost on X ·
🇰🇵 The FBI says North Korean hackers STOLE over $400M in crypto using recorded webcam videos in fake video calls. They hijacked Telegram, LinkedIn, and Slack accounts, using footage of trusted contacts to make Zoom and Teams calls look real. Once targets joined, hackers faked tech issues and tricked them into installing malware to steal wallets and credentials. The FBI seized over 900 victim videos. The same groups carried out the $6.3B Binance heist. Source: Reuters / Writer: Lucas
Open source - CB
Crypto BriefingArticle ·
US Justice Department seizes infrastructure tied to North Korea’s $400M FaceStealer crypto scheme The DOJ's actions highlight the persistent threat of state-sponsored cybercrime, emphasizing the need for enhanced global cybersecurity measures. The post US Justice Department seizes infrastructure tied to North Korea’s $400M FaceStealer crypto scheme appeared first on Crypto Briefing .
Open source - CT
Coin TelegraphArticle ·
DOJ moves to seize $1.2B from Binance hack, disrupts FaceStealer scam Authorities froze over $2.7 billion in Binance hack proceeds, while the separate FaceStealer scam stole over $400 million in 18 months.
Open source - BL
Bloomberg@businessPost on X ·
The Justice Department says it’s joined with the two biggest stablecoin issuers in efforts to secure almost half the money stolen when hackers absconded with more than $6 billion from the Binance crypto exchange https://t.co/HfhYIXUV11
Open source