DOJ seizes $1.2B in stolen Binance crypto, disrupts FaceStealer

The US Justice Department has obtained court authorization to seize or restrain more than $1.2 billion of the roughly $6.3 billion North Korean operators stole from Binance in late October, and separately dismantled the cloud infrastructure behind FaceStealer, a social-engineering campaign the FBI blames for a further $400 million in crypto theft over 18 months. The FBI issued its alert on Thursday. The announcement comes from the DOJ and FBI directly; as of writing, coverage traces to reporting at CyberScoop, SecurityWeek and The Record, and the FBI's wallet blocklists are published through ic3.gov.

The seizure

Of the ~$6.3 billion drained from Binance on or about 29 October — the largest crypto theft on record — platforms and law enforcement have frozen $2.7 billion total. The DOJ's court-authorized seizure covers $1.2 billion of that. A. Tysen Duva, assistant attorney general in the DOJ Criminal Division, said the department moved "before they got beyond law enforcement reach," halting "about half of this historic breach."

The FBI attributes the Binance theft to TraderTraitor, the North Korean group it named in its 31 October alert — the one that published 608 Ethereum, 19 Bitcoin and one Solana address holding stolen funds. The seized assets were converted primarily into Ether, per the FBI, Secret Service and IRS-CI.

FaceStealer

The second action targeted FaceStealer, which the FBI attributes to APT38 (TraderTraitor is described as a later offshoot of APT38). The mechanics:

• Lures arrive as Calendly invites to Zoom or Teams meetings, sent from accounts stolen from earlier victims.
• Links lead to typo-squatted domains hosting imposter Zoom and Teams sites.
• Victims hit a fake "technical error"; the offered fix installs malware — a browser-cookie harvester, keyloggers, screen capture and a backdoor.
• Operators play recorded videos of past victims to fake meeting participants, sometimes with AI deepfakes of crypto-industry figures.

The FBI obtained a warrant to seize the infrastructure, which held more than 900 secretly recorded webcam videos used to impersonate victims in follow-on attacks. Patrick Grandy, assistant director in charge of the FBI's Los Angeles field office, called it "a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user."

Action checklist

1. Crypto and Web3 teams: ingest the FBI's TraderTraitor wallet blocklists from ic3.gov and block/alert on the listed addresses.
2. Treat unsolicited meeting invites as hostile. Calendly/Zoom/Teams links that route to a "technical error + download the fix" flow are the FaceStealer pattern — never run a meeting-supplied installer.
3. Verify video-call participants out of band for any high-value transaction. Recorded footage and deepfakes of known figures are in active use; a familiar face on screen is not authentication.
4. Hunt endpoints that touched those lures for browser-cookie theft, unexpected keylogger/screen-capture processes, and persistence consistent with an installed backdoor.
5. If a developer was targeted, rotate credentials and audit any dependency or repo changes they could have made — APT38 has pivoted meeting-based access into software supply-chain compromise.

Context

This is the enforcement half of a pattern Hacker Posts has tracked: North Korea funding its weapons program through crypto theft, from the February 2025 $1.4 billion Bybit heist to the DOJ's prosecution of North Korean IT-worker laptop farms. The novelty here is speed and recovery — freezing roughly half of a record heist within weeks — but the FaceStealer disruption is the more durable warning: the initial access is a convincing video-call lure, not a CVE. Brett Leatherman, the FBI's Cyber Branch operations director, tied the thefts back to funding for the regime's weapons program. The FBI credited Arctic Wolf, Jumpsec and Microsoft Threat Intelligence Center for assistance.