US moves to seize $1.2 billion that North Korean military hackers stole from Binance

The US Justice Department said on 12 November that it has obtained court authorisation to seize or restrain more than 1.2 billion dollars in cryptocurrency stolen from the Binance exchange, a theft it attributes to members of North Korea's military. The department also announced that it had seized cloud-based infrastructure used in a separate North Korean hacking campaign that the FBI calls FaceStealer.

According to the department, hackers the FBI refers to as TraderTraitor stole more than 6 billion dollars in virtual assets from Binance on or about 29 October. US agencies and private-sector partners have since frozen more than 2.7 billion dollars of that total, and the 1.2 billion dollars now covered by court orders is part of the frozen amount. CoinDesk, which reported the announcement on the same day, described TraderTraitor as a North Korean military-linked hacking operation.

The department stressed that the recovery is far from complete. It said the TraderTraitor actors are still laundering the stolen assets through cryptocurrency bridges, mixers and exchanges, while investigators keep working to trace, freeze, seize and eventually forfeit the funds. Last week the FBI, working with the US Secret Service and the Internal Revenue Service, issued a cyber alert that attributed the theft to North Korea and urged virtual asset service providers to block transactions linked to the laundering addresses, Yonhap reported, citing the department.

US officials tied the case directly to Pyongyang's weapons effort. M. Scott Proctor, the principal deputy assistant attorney general for national security, said North Korea's government pays for its regime and its illicit weapons programme through cryptocurrency theft, and that his division would use every available tool to seize the proceeds. Brett Leatherman, operations director of the FBI's cyber branch, said the regime relies on large-scale crypto theft to fund weapons development and has stolen billions of dollars in recent years.

The FaceStealer scheme, the department said, has stolen more than 400 million dollars over the past 18 months. North Korean operators send invitations to video meetings from accounts taken over in earlier attacks. Once a target joins, the hackers play recorded footage of previous victims, or deepfake videos of well-known figures in the cryptocurrency industry, so that the meeting appears to include trusted contacts.

The hackers then fake a technical fault, such as claiming the target cannot be heard, and offer a fix that secretly installs malware. That gives them access to cryptocurrency and to other systems the victim can reach. In several cases the attackers stole funds or hijacked communication accounts months or more than a year after the first compromise, the department said. Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims.

The department linked FaceStealer to North Korean groups tracked under names including APT38, BlueNoroff, Sapphire Sleet and Stardust Chollima. It said the operators have increasingly targeted people who develop and maintain open-source software, in what it judged to be an attempt to gain access to software repositories and stage supply-chain attacks. Yonhap also highlighted that shift towards developers.

The FBI has published a report on how the scheme works, with protective steps and advice for victims, and has set up a dedicated web page on the campaign. By the department's own figures, the assets now under court orders amount to less than half of what has been frozen and roughly a fifth of the total taken from Binance in the October attack.