DOJ Gets Court Authority to Seize or Restrain $1.2 Billion From Binance Theft, FBI Disrupts North Korea's FaceStealer Scheme

The Justice Department said Thursday, Nov. 12, that it has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance last month. The theft totaled about $6.3 billion and is regarded as the biggest crypto heist in history.

The FBI has attributed the Binance theft to TraderTraitor, a North Korean hacking group it also tied to the Bybit hack last year. The same day, the bureau announced it had disrupted a second North Korean operation, called FaceStealer.

Officials said the two campaigns likely involved different North Korean actors.

The Binance money

The U.S. government and private companies have so far frozen more than $2.7 billion of the stolen funds. The $1.2 billion is the portion the Justice Department now has court authority to seize or restrain. It is part of that $2.7 billion total, not an additional recovery.

Assistant Attorney General A. Tysen Duva said the Criminal Division, as the department's liaison to the digital asset industry, "immediately halt[ed] about half of this historic breach." He said multiple Justice Department divisions "played the critical role in immediately freezing billions of dollars' worth of stolen Binance digital assets before they got beyond law enforcement reach."

Seizure is not the same as getting the money back to its owners. In cases like this, the government typically files a forfeiture claim, and a judge decides who has a legitimate claim to the recovered funds. A senior DOJ official said the government now has custody of the funds covered by the court orders, and that returning them would generally involve court proceedings to determine ownership, though it was too early to say exactly how that process would unfold.

The Justice Department said efforts to trace, freeze, seize and forfeit the assets are ongoing. It said TraderTraitor actors continue to launder the money through cryptocurrency bridges, mixers and exchanges. The senior DOJ official said recovering more of the money is becoming harder as the hackers divide it into smaller amounts and distribute it among laundering networks. "These actors have gotten very good at laundering," the official said. "They've learned from their past efforts and our efforts to interdict them."

Blockchain intelligence firm Elliptic said this week that North Korea's launderers are creating their own worthless tokens and running stolen assets through decentralized exchange liquidity pools, so no funds pass directly from the wallets holding stolen assets to the wallets that receive them. Elliptic said North Korea tried a similar technique last year while laundering the $1.4 billion stolen from Bybit.

Michael Barnhart, a nation-state threat researcher at DTEX, has said TraderTraitor's usual approach is to offload stolen funds quickly to Chinese money launderers for a lump sum or a percentage.

Brett Leatherman, the FBI's Cyber Branch Operations Director, said the North Korean regime "relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years."

Binance previously said attackers used a fake job interview to compromise an engineer's computer before reaching systems used to approve cryptocurrency transfers. An FBI agent told Recorded Future News it is unclear whether FaceStealer was one of the methods used to breach Binance.

How FaceStealer works

FBI officials said FaceStealer stole more than $400 million in cryptocurrency over the last 18 months. Rather than exploiting a software flaw, it exploits trust.

Hackers take over real accounts on services including Telegram, LinkedIn, Slack and Discord. They use the victim's earlier conversations to make their messages sound familiar. Jeremy Robertson, special agent in charge of the FBI's Los Angeles Field Office, described that process to reporters.

The target gets a meeting link to a site built to look like Zoom or Microsoft Teams. Inside, the target sees a recording of someone they know, sometimes with other apparent participants. A message then says their audio is broken and supplies a "fix," such as running a script or pasting commands into the terminal.

That fix installs malware that can log keystrokes, capture screens and give the hackers continued access. The fake meeting also records the new victim's webcam. That footage, plus stolen accounts and contact lists, is used to hit the next person.

"This is not something we can patch," Robertson said, calling it a "very, very convincing" social engineering scheme.

Authorities seized the cloud infrastructure behind the campaign and more than 900 webcam videos of victims.

Justin Moore, director of adversary operations at Arctic Wolf, one of the firms that has assisted the FBI, said the firm has identified more than 677 targets across 58 countries and has seen the group's social engineering playbook expand beyond fake meetings into document-sharing platforms, identity verification requests, media content and other trusted business workflows.

Open-source developers in the crosshairs

The targets included developers who maintain open-source software that other companies build on. Earlier this year, a maintainer of a JavaScript software library joined a fake Teams meeting. The FBI said hackers broke into that developer's computer and used the access to add malicious code that could reach people downloading the software. The attack was detected and stopped before it widely spread.

The FBI said this scale and creativity in Pyongyang's cryptocurrency theft operations had not been publicly outlined before.

A wider North Korean pipeline

Crypto theft is one of several revenue streams the regime runs against American targets. CrowdStrike says it is uncovering one or two suspected North Korean IT worker cases every day, where operatives use fake identities to get remote jobs at U.S. companies. Adam Meyers, CrowdStrike's head of counter adversary operations, told Fox News Digital that the workers "don't discriminate" across industries, from consumer companies to defense contractors.

Meyers said that when workers land inside a "particularly juicy target," CrowdStrike has seen the operation handed off to a malware team. He did not say whether those teams successfully collected sensitive information. The FBI has described the scheme as a "significant national security and intellectual property theft insider threat."

What comes next

The $1.2 billion is frozen or restrained, not yet forfeited. The government still has to file its claim and a judge has to rule on competing claims. Meanwhile, the rest of the stolen funds remain in play as TraderTraitor keeps moving money.