The U.S. Justice Department announced on Thursday that it obtained court authorization to seize over $1.2 billion tied to the October 29 Binance hack. This action covers a portion of the roughly $6.4 billion stolen from the exchange, with officials noting that more than $2.7 billion is already frozen. The FBI attributed the massive theft to the North Korean group TraderTraitor, which has been laundering proceeds at speed by spinning up a new wallet roughly every 25 seconds. Pyongyang denied involvement, calling the FBI’s finding a political provocation, but the scale of the seizure underscores how central crypto theft has become to the regime’s finances.
FaceStealer and Supply-Chain Threats
In a separate operation, the DOJ said North Korean hackers stole more than $400 million in cryptocurrency over 18 months using a social-engineering scheme called "FaceStealer." The group lures targets into video meetings using accounts stolen from previous victims, then plays prerecorded webcam footage of trusted contacts to simulate their presence. Attackers also generate AI deepfakes of well-known figures in the crypto industry to make the ruse more convincing. Once a target is at ease, the hackers manufacture a fake technical glitch and offer a link to fix it, which installs malware instead. From there, they drain wallets or exploit system access, sometimes waiting over a year before striking. The FBI seized over 900 webcam recordings under a federal warrant.
Targeting Open-Source Developers
The DOJ tied the FaceStealer operation to groups known as Sapphire Sleet, BlueNoroff, and APT38. Officials warned that these hackers have increasingly targeted open-source software developers in an apparent bid to enable supply-chain attacks. This shift represents a clear escalation in threat vector, moving beyond direct financial theft toward compromising foundational code used by thousands of projects. The U.S. recently sanctioned 11 people over a related North Korean IT-worker scheme that moved millions in crypto. Researchers have cataloged many ways the regime’s hackers break into crypto firms, highlighting the persistent difficulty in securing decentralized infrastructure against state-sponsored actors who operate with significant resources and patience.
