U.S. Can Seize $1.2 Billion From North Korea’s Binance Hack
The seizure follows the Binance hack linked to North Korean hackers. The FaceStealer campaign also shows how deepfakes and malware target crypto infrastructure.
Key Takeaways
- U.S. prosecutors can seize $1.2 billion in crypto from North Korea’s Binance hack.
- U.S. authorities also took over infrastructure used in the FaceStealer campaign.
- The FBI says FaceStealer tricks victims through fake video meetings and has already stolen more than $400 million in crypto.
U.S. prosecutors have been given the green light to seize $1.2 billion (€1.1 billion) in crypto taken in the hack of Binance. At the same time, the Justice Department says it has also taken over infrastructure used in the FaceStealer campaign, a North Korean operation that the FBI says has already stolen more than $400 million (€361 million) in crypto.
Major Blow Against North Korean Hackers
According to the DOJ, the seizure is part of a broader effort against North Korean cybercrime. U.S. authorities and private parties have now frozen more than $2.7 billion (€2.4 billion) of the more than $6 billion (€5.4 billion) stolen from Binance on October 29. The FBI linked that attack to TraderTraitor, a hacking group backed by the North Korean military.
Investigators are still tracking the stolen crypto through blockchain bridges, mixers, and exchanges in an effort to freeze and recover more funds. M. Scott Proctor, principal deputy assistant attorney general for national security, said North Korea uses crypto theft to fund the regime and its weapons program.
How FaceStealer Tricks Victims
Along with the Binance case, federal agents targeted cloud infrastructure used for FaceStealer. In that campaign, hackers pose as trusted contacts in fake video meetings that look like Zoom or Microsoft Teams calls. They use previously recorded webcam footage and, more and more often, AI-generated deepfakes.
Once a target joins in, the hackers report a technical problem and ask them to install software or run a command. Instead of fixing anything, that puts malware on the system, which can be used to steal crypto and gain access to other systems.
Why This Matters for Investors
The case shows how big a role cybercrime has become in the crypto market, especially in attacks that move through exchanges. For European crypto investors, the key point is that attacks are not just about wallets or exchanges, but also about developers and open-source software. The FBI warned that compromising just one developer can be enough to gain broader access.
Earlier North Korean malware campaigns also showed how hackers try to get access to wallets and development environments through social engineering and infected devices.