Justice Department Seizes Over $1.2 Billion in Binance Theft Proceeds, Dismantles North Korean Cybercrime Infrastructure
The U.S. Department of Justice announced on November 12th a dual-pronged enforcement action, securing court authorization to seize over $1.2 billion in illicit funds linked to the Binance cryptocurrency exchange theft. Simultaneously, authorities dismantled the cloud infrastructure used by a North Korean cybercrime group known as “FaceStealer” for its fraudulent operations. This marks the first time U.S. law enforcement has moved from freezing assets to actively seizing and dismantling operations following the massive $6 billion theft from Binance in late October.
The Binance case involved over $6 billion in virtual assets stolen from the exchange’s hot wallets on October 29th by “TraderTraitor,” an organization identified by the FBI as being linked to the North Korean military. The Justice Department stated that its National Security Division’s National Security Cyber Section, Criminal Division’s Computer Crime and Intellectual Property Section, and the U.S. Attorney’s Office for the District of Columbia, in collaboration with law enforcement partners and virtual asset service providers, have frozen over $2.7 billion to date. Of this amount, over $1.2 billion has now been authorized by the court for seizure and restraint, with tracking, freezing, and forfeiture efforts ongoing.
Officials clearly articulated the chain of responsibility. M. Scott Proctor, First Assistant Deputy Attorney General for the National Security Division, stated that the North Korean government relies on cryptocurrency theft to fund its rogue regime and illicit weapons programs. He emphasized that this operation demonstrates the U.S. will counter such actions directly and will utilize all available tools to seize illicit proceeds and return them to victims.
Assistant Attorney General for the Criminal Division, A. Tysen Duva, provided context on the timing. He noted that the Computer Crime and Intellectual Property Section acted before the stolen funds could be moved beyond law enforcement’s reach, effectively intercepting “approximately half” of what is considered the largest theft in history at its earliest stages. Jeanine Ferris Pirro, U.S. Attorney for the District of Columbia, highlighted the $1.2 billion seizure as a concrete response to North Korea’s actions. Comparing the $1.2 billion seized to the $2.7 billion frozen and the $6 billion stolen, the remaining portion represents funds not yet intercepted.
FaceStealer Network Disrupted, Victim Footage Seized
In a separate but related action, the U.S. Attorney’s Office for the Central District of California announced the disruption of the “FaceStealer” fraud network. The FBI indicated that FaceStealer has stolen over $400 million in crypto assets over the past 18 months. The group’s modus operandi involves sending video conferencing invitations, with the compromised accounts used to send these invitations belonging to previous victims. Once a target joins a meeting, hackers play pre-recorded footage of acquaintances, creating the illusion of a trusted contact. In the past year, the group has escalated to using AI-generated deepfakes of prominent figures in the cryptocurrency space. The FBI, acting on federal search warrants, seized over 900 segments of victim webcam footage, which are being used as fodder for future scams.
The operational mechanics are described as straightforward. After a target joins a meeting, the hackers claim to have audio issues and provide a link to a supposed fix or instruct the user to execute a command. This “fix” actually installs malware, granting the attackers not only the ability to steal cryptocurrency but also to gain access to other systems the victim uses. The Justice Department noted that in multiple cases, the theft of coins and hijacking of communication accounts occurred months, or even over a year, after the initial intrusion. During this period, hackers meticulously combed through contact lists, social media, and messaging applications, leveraging the victim’s personal and professional relationships for subsequent attacks.
Shifting Tactics and Supply Chain Threats
The organizations involved in these operations are known by multiple aliases within the intelligence community, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima. A significant shift in tactics is also noteworthy: the Justice Department stated that these actors have recently begun targeting developers and maintainers of open-source software, attempting to seize their device and code repository accounts. This indicates a clear motivation towards supply chain attacks, where compromising a maintainer provides access to an entire software update pipeline.
The FBI released a report detailing the full mechanism of FaceStealer and its prevention methods, and established a dedicated webpage to consolidate relevant resources. Patrick Grandy, Assistant Director of the FBI’s Los Angeles Field Office, stated that this technique “can ensnare even the most seasoned and security-conscious computer users,” exploiting trust in video conferencing platforms and personal relationships. This operation was led by Khaldoun Shobaki, Assistant U.S. Attorney for the Central District of California, and the FBI’s Los Angeles Field Office.
Understanding the Enforcement Tiers
Examining the figures side-by-side reveals a three-tiered approach to enforcement outcomes. The outermost tier is the $2.7 billion in frozen assets, representing approximately 45% of the stolen amount. This reflects funds intercepted by exchanges, stablecoin issuers, and on-chain analytics firms within hours of the incident. The middle tier is the $1.2 billion authorized by court for seizure and restraint. Funds reaching this stage gain a legal basis for future forfeiture and return to victims. The innermost tier comprises over $3 billion that remains in active movement on the blockchain and has not yet been frozen. The substantial seizure amount does not equate to the total recovered funds; readers may overestimate the progress of this offensive and defensive operation if they interpret the $1.2 billion as fully recovered.
The Ongoing Pursuit and Evolving Compliance Landscape
The cost of recovery is also unevenly distributed. The Justice Department acknowledged that TraderTraitor continues to move assets through cross-chain bridges, mixers, and exchanges. This is why the FBI, in conjunction with the Secret Service and IRS Criminal Investigation, issued a cyber alert last week urging virtual asset service providers to block transactions from specific addresses. In early November, the FBI had already identified approximately 600 addresses associated with money laundering. Subsequent on-chain analysis has revealed that these stolen funds are being fragmented across multiple chains and token types, meaning the smaller the list of addresses that can be frozen, the smaller the pool of assets that can be seized.
For virtual asset service providers, this operation effectively raises the compliance bar. Court-authorized seizure lists and FBI address lists will directly translate into blocking obligations for exchanges. Slow cooperation could theoretically lead to accusations of “aiding money laundering.” For compliance departments that already designate North Korea as a high-risk region, the focus will now shift to outbound transactions from mixers and inbound transactions from cross-chain bridges, rather than solely examining deposit addresses.
For industry professionals and developers, the FaceStealer alert is more immediate. It does not require victims to click on unfamiliar links, but rather a seemingly legitimate video conference. Invitations for these fraudulent meetings often originate from the email accounts of individuals the victim actually knows. Taiwanese exchange teams and open-source project maintainers are also within the target range. Practically, the recommendation is to treat any request during a meeting to install software or execute commands as a red line, and to secure maintainer accounts with hardware keys. Future observations will focus on two key areas: whether North Korea accelerates its use of difficult-to-trace pathways like meme coins to cash out before assets are frozen, and whether U.S. authorities will target offshore exchanges that facilitate money laundering channels.
