The Department of Justice (DOJ) has obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance by North Korean military hackers. The DOJ aims to freeze the stolen funds related to a $6.3 billion cyberattack and is part of a broader strategy to interfere with cryptocurrency-theft operations.
Table of Contents
The U.S. government, together with other partners, has frozen more than $2.7 billion of the stolen cryptocurrency since the October 29 cyberattack. The amount frozen by the Department of Justice constitutes almost half of the frozen stolen funds, while investigations to trace the rest of the cryptocurrency are still ongoing. The FBI attributed the attack to TraderTraitor.
The enforcement action announced on November 12 also includes an action against another North Korean hacker named FaceStealer, who has stolen more than $400 million of cryptocurrency in 18 months through pre-recorded videos and deepfake technology.
Also Read | Cardano Academy and Andamio Launch On-Chain Credential Program
Department of Justice Targets North Korean Crypto Theft
DOJ claims that the DPRK uses cryptocurrency theft as a means of generating money to fund their government and illicit weaponry. The latest set of actions includes various agencies like the National Security Division, Criminal Division, FBI, U.S. Secret Service, and IRS Criminal Investigation.
The involvement of virtual asset service providers made it possible for the authorities to freeze billions of dollars before the money left their jurisdiction. Assistant Attorney General A. Tysen Duva explained that Criminal Division and its colleagues acted fast to stop about half of the huge Binance hack.
The court ordered the government to seize or restrain more than $1.2 billion out of $2.7 billion frozen by the government. It is important to make this difference clear since the freezing of cryptocurrency means preventing the movement of money, while restraining means obtaining the right to seize the funds.
TraderTraitor Moves Stolen Binance Assets Through Crypto Networks
FBI stated that military members of the Democratic Peopleās Republic of Korea were behind the attack on Binance on October 29 and used the alias āTraderTraitor.ā The FBI in its cyber alert issued on October 31 mentioned that the attackers were transferring the assets to the account where the stolen assets were being converted to Ether (ETH).
The FBI said that attackers would be using decentralized finance (DeFi) applications and instant swap services to convert the cryptocurrencies into other forms of funds. This would make the tracing of transactions more difficult for investigators as funds will get transferred through multiple blockchain networks and digital assets.
The FBI has appealed to cryptocurrency exchange operators, DeFi services, blockchain intelligence firms, and infrastructure providers to block any transactions in connection with the given wallet addresses. The FBI released the wallet addresses used by the attackers for laundering the cryptocurrencies.
The investigation is still underway as North Korean hackers keep trying to move the stolen funds using cryptocurrency bridges, mixers, and exchanges.
FaceStealer Uses Deepfakes to Steal More Than $400 Million
Alongside the Binance-related action, the Department of Justice announced the seizure of cloud-based infrastructure used in FaceStealer. According to the Federal Bureau of Investigation, the investigation revealed that perpetrators had compromised people engaged in cryptocurrency, Web3, and open-source software development and stole more than $400 million of cryptocurrency over 18 months.
The video meetings were arranged using the compromised accounts. The hackers used pre-recorded footage of people known to the victims during the video calls. In addition to these videos, they utilized artificial intelligence videos to impersonate influential people in the cryptocurrency and Web3 space.
During the video call, they posed different false technical issues, such as an inability to hear the victim during the calls. They would then give them links or prompts for fixes, which would lead to the installation of malware on the victimsā devices that gave access to cryptocurrency and other information.
The attackers would wait for months or even years after the initial infection of the computer before conducting thefts or hijacking the communication accounts. They would also use the compromised computers to get access to the victimsā contacts, social media accounts, and messages to get more targets.
Over 900 webcam recordings were seized by FBI using a warrant issued by a federal court. The law enforcement agency also disrupted the cloud computing resources used in the campaign. A technical report was made by the FBI on how the campaign was done.
Department of Justice Action Highlights Risks to Crypto and Software Developers
FaceStealer was another campaign that targeted developers of open-source software. This campaign was aimed at hacking accounts of people responsible for the development and maintenance of software in order to perform supply-chain attacks on applications of other organizations.
The impact of this attack is wider than just cryptocurrency holders. Hackers may be able to harm not only people working with cryptocurrencies but also software companies and their products. Therefore, businesses operating with open-source software might be at risk even if they are not dealing with cryptocurrencies.
Patrick Grandy, Assistant Director of FBI Los Angeles Field Office, said that the operation could deceive even technical experts by using trustful contacts and reliable videoconferencing tools. As Grandy noted, people who did not believe that they could be deceived by such attacks may not have considered all the possible ways.
For cryptocurrency businesses, the developments reinforce the importance of checking meeting invitations, verifying identities through separate communication channels, and avoiding unfamiliar software installation prompts. In addition, wallet monitoring and rapid response to law enforcement notifications became crucial for exchanges and infrastructure providers.
According to the Department of Justice, the tracing, freezing, seizure, and forfeiture of assets of Binance continues. Investigations into both operations conducted by FBI, TraderTraitor and FaceStealer is ongoing and requests for suspicious activities reports have been made by the authorities.
Also Read | NVIDIA Shares Fall 9.7% After Jensen Huang Resigns as CEO
Bena Ilyas is a Global News Correspondent and Market Analyst at Tronweekly with over four years of experience covering global cryptocurrency, blockchain, and Web3 developments. She has written 1,000+ articles for leading crypto news platforms, reporting on Bitcoin, Ethereum, altcoins, DeFi, and global crypto regulation, alongside Web3 trends, Layer 2 ecosystems, and AI-driven crypto use cases. Her work is based on verified sources and fact-based reporting for global market participants.
