US Moves to Seize, Freeze More Than $1.2 Billion Stolen by North Korea From Binance

More Than $2.7 Billion Frozen Through Public-Private Cooperation

Court Authorizes Seizure and Freeze of More Than $1.2 Billion

The US government has secured court approval to seize or freeze more than $1.2 billion in cryptocurrency that North Korean hackers stole from Binance. Authorities also seized North Korea’s hacking infrastructure, which used video calls featuring stolen identities to install malware.

On Nov. 12, the Justice Department announced the results of a joint operation aimed at disrupting North Korea’s large-scale cryptocurrency theft and money laundering. More than $2.7 billion of the stolen Binance funds has been frozen through cooperation between government agencies and private companies. That total includes the more than $1.2 billion covered by the court order.

The Federal Bureau of Investigation had earlier identified hackers tied to the North Korean military as being behind the Binance hack that took place on Oct. 29. The group, which the FBI calls TraderTraitor, has stolen more than $6 billion in cryptocurrency from Binance and has been laundering the proceeds through cross-chain bridges, exchanges and mixers.

The Justice Department and FBI are tracing additional funds with the US Secret Service, the Internal Revenue Service Criminal Investigation division and cryptocurrency firms. The FBI previously said it detected the attackers converting the stolen assets primarily into Ethereum and asked the industry to block transactions linked to the wallets involved.

Scott Procter, principal deputy assistant attorney general for national security at the Justice Department, said North Korea is funding its regime and illegal weapons programs through cryptocurrency theft. Authorities will use every available means to seize and return the illicit proceeds, he added.

The Justice Department also said it had seized cloud infrastructure used in so-called Facestealer attacks, which caused more than $400 million in losses over the past 18 months. The scheme targeted workers in the cryptocurrency and Web3 industries through fraudulent video meetings.

Attackers used accounts taken from earlier victims to send video-meeting invitations to their acquaintances. During the calls, they played recorded footage of someone the victim knew or deepfake videos of well-known figures in the industry to make it appear they were taking part in a live conversation. They also recorded the faces of new victims and used that footage in later attacks.

The hackers then claimed there was a technical problem, such as saying they could not hear the victim. They told targets they needed to click a link or install a program to fix the issue. That process installed malware on the victim’s computer. The hackers then used it to steal cryptocurrency or break into other systems the victim could access.

Investigators also found cases in which assets were stolen not immediately after the malware was planted, but months or more than a year later. After obtaining a victim’s contacts and access to social media and messaging accounts, the attackers sometimes widened their targeting to people around them.

More recently, the group has also targeted open-source software developers and maintainers. Investigators said the effort was aimed at taking over developers’ computers and source-code repository accounts to infiltrate the software supply chain. Under a court warrant, the FBI obtained more than 900 webcam videos of victims.

Patrick Grandy, head of the FBI’s Los Angeles field office, said the attacks were sophisticated enough to deceive even skilled technologists with a strong awareness of security risks. They exploit trust in everyday video-conferencing platforms and in people the victims know, he said.