The U.S. Department of Justice (DOJ) announced that it has received court approval to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance by North Korean hackers. This amount is part of over $2.7 billion in digital assets already frozen through a combined effort by government agencies and private companies responding to one of the largest breaches in the crypto sector’s history.
Largest Crypto Theft Targeted by U.S. Agencies
According to the DOJ, members of North Korea’s military – identified by the Federal Bureau of Investigation (FBI) as the cyber unit “TraderTraitor” – stole more than $6 billion in virtual assets from Binance on or around October 29. Out of this, $1.2 billion has now been seized or restrained following court authorization. Assistant Attorney General A. Tysen Duva of the DOJ’s Criminal Division stated that the division moved quickly to halt about half of the breach’s impact.
Assistant Attorney General A. Tysen Duva reported that efforts to freeze the digital assets aimed to immediately stop additional losses following the hack.
In the aftermath, security experts highlighted the speed of the industry’s response. Pablo Sabbatella, founder of cybersecurity firm Opsek, said days after the incident that, unlike most hacks where funds quickly disappear, the broader crypto sector managed to freeze significant amounts rapidly.
Ongoing Threats and Evasion Tactics
Despite the ongoing investigations, authorities noted that North Korean hackers continue to move digital assets through various channels, including blockchain “bridges,” coin mixers, and cryptocurrency exchanges. On October 31, the FBI, Secret Service, and IRS Criminal Investigation issued a joint alert identifying North Korea as the perpetrators and urging virtual asset service providers to block any activity connected to TraderTraitor addresses.
Blockchain analytics firm Elliptic recently reported that some stolen assets were funneled through custom-made meme coins, highlighting the evolving strategies employed to evade detection.
Mini dictionary: Coin mixer, a technology that obscures cryptocurrency transaction trails by combining multiple transactions, making it harder to link specific coins to individuals or criminal activity.
Principal Deputy Assistant Attorney General M. Scott Proctor confirmed the National Security Division’s commitment to using all available tools to seize and recover North Korea’s illicit crypto assets.
FaceStealer Operation and Cybersecurity Risks
In a separate case, federal prosecutors in Los Angeles revealed that they had disrupted the cloud infrastructure behind the “FaceStealer” campaign, which used stolen webcam footage to impersonate trusted faces in video calls. The FBI links this operation to thefts exceeding $400 million over the past 18 months, and agents have seized over 900 webcam videos under a federal warrant.
The DOJ stated that hackers lured victims by sending invites from compromised accounts and playing clips of familiar contacts before triggering a fake technical glitch that led targets to install malware.
The department also uncovered attempts by the group to create deepfakes of prominent figures in the crypto space, although a recent FBI technical report notes that their scams still primarily use genuine stolen footage.
Open-source developers have emerged as a prime target for these schemes. The FBI previously found that an individual responsible for managing a widely-used JavaScript library narrowly avoided spreading a malware infection after being targeted with a fraudulent Microsoft Teams call.
Mini dictionary: Deepfake, a synthetic media technique that uses artificial intelligence to generate remarkably realistic but completely fabricated images or videos, often used to impersonate individuals in fraudulent activities.
