The US Justice Department said on November 12 that it had obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, part of more than $2.7 billion frozen through government and private-sector efforts. In a separate action, authorities seized cloud infrastructure used in FaceStealer, a North Korean impersonation scheme that the FBI says has stolen more than $400 million over the past 18 months and increasingly targets open-source software developers.
The announcements concern two distinct operations with different consequences for security teams. Cryptocurrency service providers are being asked to block transactions tied to the Binance theft, while cryptocurrency professionals and software maintainers face video-meeting invitations that can lead to malware installation and account hijacking.
Binance recovery efforts continue
In its announcement, the Justice Department said members of the North Korean military, tracked by the FBI as TraderTraitor, stole more than $6 billion in virtual assets from Binance on or about October 29. SecurityWeek reported the theft at about $6.3 billion and described it as the largest cryptocurrency heist in history.
US authorities have since worked with virtual asset service providers—businesses that handle cryptocurrency transfers and related services—to intercept the stolen assets. The more than $1.2 billion covered by court authorization is part of the more than $2.7 billion already frozen, rather than an additional recovery.
Tracing and recovery work remains underway as TraderTraitor moves assets through cryptocurrency bridges, which transfer assets between blockchain networks; mixers, which obscure transaction trails; and exchanges. The FBI’s Los Angeles Field Office, Cyber Division and Virtual Asset Unit are coordinating its recovery efforts with the US Secret Service and the Internal Revenue Service’s criminal investigators.
Court authorization to seize or restrain assets is a step in that process. SecurityWeek explained that the government typically files a forfeiture claim, after which a judge determines who has a legitimate claim to the recovered funds.
FaceStealer turns trusted contacts into malware lures
The separate FaceStealer action disrupted cloud infrastructure used to impersonate trusted contacts during video meetings. The Justice Department attributed the scheme to North Korean hackers publicly tracked under names including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.
The attack begins with a meeting invitation sent from an account stolen from an earlier victim. When the new target joins, the attackers record that person’s webcam feed and play recordings of previous victims whom the target knows. The aim is to make familiar people appear to be participating in the call.
The department also said the attackers use what it calls “super intelligence” to develop deepfake videos—synthetic videos impersonating real people—of influential figures, often from the cryptocurrency and Web3 industries. Those videos provide another way to make the meeting appear credible.
Once the target trusts the call, the attackers introduce a supposed technical problem. For example, they may claim the target’s microphone is not working, then offer a link or prompt to repair it. That purported fix secretly installs malware on the target’s computer.
Access to the device can then allow cryptocurrency theft or exploitation of the victim’s access to other systems. The consequences can be delayed: in several reported cases, attackers stole cryptocurrency and hijacked communications accounts several months to more than a year after the initial compromise.
The attackers also access victims’ contact lists, social media and communications apps, using those connections to approach further personal and professional contacts. Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims; that figure counts videos, rather than affected people.
Software maintainers are also targets
Beyond cryptocurrency and Web3 professionals, FaceStealer increasingly targets people who develop and maintain open-source software. The Justice Department said attackers have attempted to compromise their devices and the software repository accounts they control. It assessed that this targeting appears intended to enable software supply-chain attacks, in which trusted software or its development process becomes a route to other systems.
US officials attribute both operations to North Korea’s efforts to fund its government and illicit weapons program. The infrastructure seizure was led by the US Attorney’s Office for the Central District of California and the FBI’s Los Angeles Field Office.
For cryptocurrency service providers, the immediate action comes from a Cyber Alert issued the previous week by the FBI with the Secret Service and IRS criminal investigators: block transactions with, or derived from, the cryptocurrency addresses identified as being used to launder the stolen Binance assets.
For people exposed to FaceStealer, the FBI has published a report covering the attack’s mechanics, protective practices and steps for victims after a compromise. It has also established a central resource hub for information on the scheme.
