FBI seizes tools used by North Korean hackers, freezes $1.2bilion in stolen Binance funds

The us DoJ said it obtained a court order to "freeze or seize" $1.2 billion out of the $6.7bn stolen from Binance It also disrupted the infrastructure used in FaceStealer attacks Most of the Binance funds remain unaccounted for The US Department of Justice (DoJ) has said it was granted court authori

<![CDATA[ <article> <ul><li><strong>The us DoJ said it obtained a court order to "freeze or seize" $1.2 billion out of the $6.7bn stolen from Binance</strong></li><li><strong>It also disrupted the infrastructure used in FaceStealer attacks</strong></li><li><strong>Most of the Binance funds remain unaccounted for</strong></li></ul><p>The US Department of Justice (DoJ) has said it was granted court authorization to “seize or restrain” $1.2 billion recently stolen from Binance. </p><p>In late October 2026, <a href="https://www.techradar.com/pro/security/binance-hit-by-largest-crypto-theft-on-record-as-north-korean-hackers-steal-usd6-3bn-in-just-20-minutes">Binance reported losing $6.7 billion</a> in a highly sophisticated heist that played out over roughly 20 minutes. In the days that followed, we learned that <a href="https://www.techradar.com/pro/security/fbi-confirms-it-thinks-north-korean-hackers-hit-binance-in-record-cryptocurrency-heist">the heist was carried out by TraderTraitor</a>, a subset of the infamous Lazarus Group, notorious North Korean state-sponsored threat actors responsible for some of the biggest crypto robberies to ever happen.</p><p>The community rallied around Binance, helping trace the funds and label the attackers’ wallets. Now, US law enforcement says at least part of those funds was seized or frozen. The agency did not say what that meant, how it was done, or if Binance will ever see those tokens again. </p><h2 id="almost-3bn-seized">Almost $3bn seized</h2><p>“Since the theft, the National Security Division’s National Security Cyber Section, the Criminal Division’s Computer Crime and Intellectual Property Section, the U.S. Attorney’s Office for the District of Columbia, and law enforcement partners have worked closely with virtual asset service providers (VASPs) to interdict the stolen assets,” the DoJ said in the announcement. </p><p>“Collective U.S. government and private sector efforts so far have resulted in the freeze of more than $2.7 billion, with the Department having already obtained court-authorization to seize or restrain in excess of $1.2 billion of that amount.”</p><p>In the same report, the DOJ also said the US government disrupted cloud-based infrastructure that North Korean hackers used in a social engineering scheme called FaceStealer. This scheme was allegedly not used in the Binance hack, but it did result in the theft of around $400 million over the last 18 months, cumulatively. Furthermore, the methodology is almost identical to what TraderTraitor used in its attack.</p><h2 id="facestealer">FaceStealer</h2><p>We also learned that the preparation for the attack took months, and that the group broke into Binance through an employee’s device. That employee was allegedly invited to a fake job interview, through which they were served malware that ultimately granted TraderTraitor valuable access. How they escalated that access into the biggest crypto heist ever remains to be seen.</p><p>The group pulled the money from 10 different chains, including Bitcoin, Ethereum, XRP, Solana, Arbitrum, and others. Once the money - which belonged to Binance and not its customers - left the company’s wallets, it was sent to different “mixers” and other laundering services. </p><p>FaceStealer is a scheme that does exactly what the name suggests - steals people’s faces, so that they can be used in identity theft which is a vital cog in the larger crypto theft engine. </p><p>According to the DoJ, criminals would first compromise an account belonging to their target’s contact, and try to get them on a video call. That call would be done on a fake Zoom platform - their victim would see their contact’s video feed which, in reality, was just a previously stolen recording. They would hear no audio, and would then receive a message that they need to update their computer’s driver to be able to hear audio and participate in the call. The driver, in this scenario, is the malware, usually either an infostealer or a steppingstone into a wider network. </p><p>North Korean state-sponsored actors are some of the most active and most disruptive hackers around. Multiple sources from the cybersecurity community claim the government is using the stolen money to fund its state apparatus, as well as its nuclear weapons programme. </p><p>On the odd occasion the North Korean government responds to these allegations, it usually just dismisses them as baseless and instead accuses the US of doing the same thing.</p><p><em>Via </em><a href="https://www.theregister.com/cyber-crime/2026/11/12/doj-takes-aim-at-12b-in-binance-loot-as-fbi-disrupts-north-korean-scam/5309523" target="_blank"><em>The Register</em></a></p> </article> ]]>