DOJ takes aim at $1.2B in Binance loot as FBI disrupts North Korean scam

The U.S. government has obtained court authorization to seize or restrain over $1.2 billion in assets stolen during the recent Binance heist, as part of a broader effort to disrupt North Korea's ongoing cryptocurrency theft. This follows the takedown of cloud-based infrastructure used in a DPRK social engineering scheme called "FaceStealer," which has amassed more than $400 million in the past 18 months.

FaceStealer involves secretly recorded webcam videos of victims working in the cryptocurrency and web3 industries, as well as open source software developers and maintainers. The North Koreans send targets an invitation to join a video meeting, often from hijacked accounts that may appear familiar or credible. The link directs the victim to a fake Zoom or Teams meeting, where they are recorded while a phony, prerecorded video plays.

Sometimes, the hackers use deepfake videos of well-known individuals in the crypto and web3 industries.

According to special agent Jeremy Robertson of the FBI Los Angeles, the attack begins with a convincing invitation to a video meeting, followed by the installation of cryptocurrency-stealing malware on the victim's computer. The malware also sends the victim's contact list to the digital thieves. The FBI attributes FaceStealer to a North Korea-linked group known as Sapphire Sleet, which is widely regarded as a Lazarus Group offshoot.

The Justice Department's court authorization covers more than $1.2 billion of the $6.3 billion stolen in the Binance heist. Since the theft, federal investigators and private-sector partners have helped freeze over $2.7 billion in stolen assets.