The United States Department of Justice (US DOJ) has seized and restrained more than $1.2 billion in cryptocurrency stolen from the exchange Binance by North Korean military hackers, while simultaneously dismantling cloud infrastructure behind a separate $400 million social engineering scheme known as “FaceStealer,” according to a department press release.
The Binance interdiction follows a massive October 29 breach in which a North Korean military hacking unit tracked by the FBI as “TraderTraitor” stole over $6 billion in digital assets. Through coordinated efforts between the DOJ, the FBI, the U.S. Secret Service, the Internal Revenue Service, and private virtual asset service providers, authorities have frozen more than $2.7 billion of the stolen funds and secured court authorization to seize over $1.2 billion. Law enforcement continues to trace the remaining assets as hackers attempt to launder them through cryptocurrency bridges, mixers, and exchanges.
In a parallel action led by the U.S. Attorney’s Office for the Central District of California and the FBI’s Los Angeles Field Office, authorities disrupted servers supporting the FaceStealer campaign. Active for 18 months, the operation has stolen over $400 million and targeted developers maintaining open-source software supply chains.
Operating under aliases including BlueNoroff, APT38, and Sapphire Sleet, the hackers use hijacked accounts to lure targets into video calls. They play surreptitiously recorded webcam footage of prior victims or deepfakes of prominent cryptocurrency figures to build trust before fabricating a technical glitch and sending a malware-laced “fix.” Authorities seized over 900 victim webcam videos used in these attacks.
“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, Principal Deputy Assistant Attorney General for National Security.
