DOJ Seizes $1.2B from Binance Hack, FBI Links Attack to North Korea
- The DOJ has authorized the seizure of $1.2 billion in stolen Binance cryptocurrency.
- Total assets frozen by the U.S. related to the Binance hack have reached $2.7 billion.
- The FBI attributes the October 29 hack to the North Korean group TraderTraitor.
- Binance has covered the stolen assets using its own company funds and insurance reserves.
- The FBI also dismantled the FaceStealer campaign, which stole $400 million via social engineering.
The FBI confirmed the seizure of these virtual assets on Thursday.
The United States has also seized cloud infrastructure used by the North Korean hackers.
These legal actions are intended to prevent the proceeds of the hack from funding the North Korean regime's weapons program.
Total U.S. asset freezes reach $2.7 billion
The United States government released details regarding this total freeze on Thursday.
U.S. officials tracked these funds through virtual asset service providers to reach the $2.7 billion total. While the government has restricted the disposal of these funds, the full amount has not yet been finally forfeited.
On October 31, the FBI, the U.S. The agencies advised virtual asset service providers to block transactions linked to addresses used by the hackers, who investigators noted were primarily converting stolen assets into ether.
The recovery operation is managed by the FBI’s Virtual Asset Unit, Cyber Division, and the Los Angeles Field Office. This effort is being conducted in coordination with the IRS-CI and the Secret Service.
TraderTraitor group linked to $6 billion Binance heist
The FBI has attributed the October 29 theft of more than $6 billion in virtual assets from Binance to a North Korean military-linked hacking group identified as TraderTraitor.
The $1.2 billion currently under court authority is drawn from the approximately $2.85 billion that Binance reported as frozen or intercepted on November 3.
Binance covers stolen assets using internal funds
Binance has fully covered the stolen assets by replacing the tokens using its own company funds. These funds were sourced from the company's Secure Asset Fund for Users, treasury, and a portion of its futures insurance fund, rather than through the recovery of the stolen coins.
North Korea denies involvement in Binance hack
Kim Yo Jong, the sister of North Korean leader Kim Jong Un, has denied any North Korean involvement in the Binance hack. She characterized the FBI's attribution as a "grave political provocation" against the DPRK.
FBI disrupts FaceStealer social engineering campaign
The operation is linked to North Korean groups identified as APT38, BlueNoroff, and Sapphire Sleet.
The FaceStealer scheme utilizes AI deepfakes and prerecorded webcam footage to trick targets into installing malware under the guise of fixing a technical error. These meetings involve imposter versions of Microsoft Teams, Zoom, and Google Meet, with invitations distributed through compromised Slack, LinkedIn, Discord, or Telegram accounts.
The agency has established a resource hub for the investigation at fbi.gov/facestealer.
U.S. officials link crypto theft to weapons funding
The U.S. Assistant Attorney General A. Tysen Duva of the department’s Criminal Division said officials were able to "immediately halt about half of this historic breach" by freezing assets before they moved beyond law enforcement reach.
Hackers use complex laundering and IT-worker schemes
The hackers are creating a new crypto wallet approximately every 25 seconds to move these proceeds.
Hackers are increasingly targeting open-source software developers in an effort to enable supply-chain attacks.
Frequently Asked Questions
- DOJ Wins Authority To Seize $1.2 Billion From Binance Hack (bitcoinmagazine.com)
- North Korea Stole $400 Million in Crypto Using Deepfake Video Calls, DOJ Says (decrypt.co)
- U.S. freezes $2.7 billion in assets tied to North Korean hackers after Binance hack (digitaltoday.co.kr)
Add NewsPulse Time as a preferred source on Google