DOJ Says It Can Seize or Restrain Over $1.2 Billion Stolen From Binance, Targets North Korea's FaceStealer Scam

Key points

• The US Department of Justice said on Thursday 12 November that it has court authorisation to seize or restrain more than $1.2 billion of the crypto stolen from Binance, out of more than $2.7 billion frozen so far.
• The department says North Korean military hackers, which the FBI calls TraderTraitor, took more than $6 billion in virtual assets from the exchange on or about 29 October.
• Separately, prosecutors in the Central District of California disrupted cloud infrastructure behind a scheme called FaceStealer, which the department says has cost victims more than $400 million over the past 18 months.
• The FBI seized more than 900 webcam videos of FaceStealer victims under a federal warrant.
• The release announces no indictments, forfeiture complaints or sanctions.

The Binance assets

The Justice Department said North Korean military hackers stole more than $6 billion worth of virtual assets from Binance on or about 29 October. Joint efforts by the US government and private companies have frozen more than $2.7 billion of it, according to the release. The department has already obtained court authorisation to seize or restrain more than $1.2 billion of that amount.

The department said work to trace, freeze, seize and ultimately forfeit the stolen assets continues, and that the hackers keep moving funds through bridges, mixers and exchanges. The FBI, the Secret Service and the IRS criminal investigation unit had issued a cyber alert the previous week blaming North Korea for the theft and urging crypto service providers to block transactions involving addresses the TraderTraitor group uses.

The figures match earlier reporting. The Record reported on 2 November that the FBI and Secret Service blamed TraderTraitor for the Binance theft, putting the amount at more than $6.3 billion, and that blockchain security experts estimated about $3 billion had been frozen at that point.

How FaceStealer works

The second action targets a social engineering scam the FBI calls FaceStealer. According to the release, attackers send video-meeting invitations from accounts taken from earlier victims. During the call they record the target's webcam and play prerecorded or deepfake clips of people the victim trusts. They then stage a fake technical fault, such as an audio problem, and push a supposed fix that installs malware.

That malware lets the attackers steal crypto and reach other accounts, sometimes months or more than a year later. The department said the group goes after people in the crypto and Web3 industries as well as developers and maintainers of open-source software. The prosecutors' office in the Central District of California disrupted the cloud infrastructure involved, and the FBI has published a report with protective advice and set up a page for victims.

The release links the activity to several names used by security researchers for North Korean groups, including BlueNoroff, APT38 and Sapphire Sleet.

What officials said

M. Scott Proctor of the department's National Security Division said North Korea funds its regime and weapons programmes through crypto theft and that the department will seize the proceeds and return them. Criminal Division head A. Tysen Duva credited the speed of the response with freezing the Binance funds, which he said stopped roughly half of the breach.

What is not yet known

The release does not say how the recovered Binance assets would be returned or on what timetable, and it does not name defendants. Forfeiture of assets of this size normally takes court proceedings, so the amounts that are finally recovered could differ from the amounts now frozen.

This report is based on the Justice Department's own release and on The Record's earlier coverage of the Binance theft.