Binance Hack Leads US to Target $1.2 Billion in Stolen Crypto

TLDR:

• Binance hack losses topped $6 billion; over $2.7 billion was frozen, including more than $1.2 billion covered by court orders.
• The FBI attributes the attack to North Korean hackers known as TraderTraitor, while North Korea has denied any involvement.
• Authorities seized FaceStealer infrastructure after the separate fake-meeting scheme stole more than $400 million over 18 months.
• The FBI seized over 900 webcam videos that hackers could use to impersonate victims during fake calls with their trusted contacts.

U.S. authorities have obtained court approval to seize or restrain more than $1.2 billion stolen in the Binance hack. The Justice Department announced the action on Nov. 12, two weeks after the exchange reported the theft. The amount forms part of more than $2.7 billion frozen through government and private-sector efforts.

The FBI attributed the attack to North Korean hackers, while Binance estimated the loss at $6.34 billion. In a separate operation, agents seized cloud infrastructure linked to FaceStealer, a fake video-call scheme. Federal officials say the campaign stole more than $400 million in cryptocurrency over the past 18 months.

Binance Hack Funds Face US Seizure After Court Orders

The FBI attributed the Binance hack to TraderTraitor, a group it links to North Korea. The attack occurred on Oct. 29 and affected several cryptocurrencies held by the exchange.

North Korea has denied involvement in the theft. U.S. officials say cryptocurrency theft helps fund the country’s government and weapons programs.

The more than $1.2 billion covered by court authorization is included in the larger frozen total. It is not an additional sum to be added to the $2.7 billion, the Justice Department said.

Freezing assets can prevent them from being moved. Court-authorized seizure or restraint is another step in the legal process. Neither figure means that all the stolen cryptocurrency has been recovered or returned.

Investigators are still tracing the assets as hackers move funds through exchanges, mixers and bridges, according to the department. Bridges transfer assets between blockchains, while mixers can obscure their transaction histories.

After the Binance hack, the FBI said it had observed the attackers converting stolen assets primarily into Ether. The agency urged crypto service providers to block transactions linked to identified addresses.

Binance said attackers accessed an internal wallet-signing service and initiated transfers outside its normal withdrawal process. Its investigation described a multistage operation involving fake job interviews, malware downloads and compromised internal tools. Binance said independent security firms would provide further reviews after the attack.

On Nov. 12, Binance said it had completed coverage of assets affected by the Binance hack using company resources. It published a new reserve snapshot, but the accompanying cryptographic proof was still pending. Replacing affected assets does not mean the exchange has recovered all the stolen coins.

How FaceStealer Used Fake Meetings to Steal Crypto

Authorities announced the FaceStealer enforcement action separately from the Binance hack case. The DOJ said it seized cloud infrastructure used by North Korean hackers behind the campaign.

The FBI said FaceStealer targeted people working in cryptocurrency and Web3. Attackers also increasingly pursued developers who maintain open-source software.

The scheme began with compromised messaging accounts belonging to earlier victims. Hackers used those accounts to invite contacts to video meetings on sites resembling Zoom or Microsoft Teams.

Once inside, targets saw recordings of people they recognized, according to investigators. Attackers also used AI-generated videos of well-known figures in the crypto industry in some cases.

The hackers then claimed there was a technical problem, such as an audio issue. They supplied a link or instructions for a supposed fix that instead installed malware. The software could help them steal cryptocurrency or access other systems.

Compromised accounts gave attackers access to contacts and past conversations. That information helped them approach new targets with messages that appeared to come from someone familiar.

Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims. Investigators said attackers could reuse recordings from one victim to impersonate that person in later meetings.

The FBI also warned that access to a developer’s device or software accounts could enable attacks on widely used applications. Such a breach could expose people who download software maintained by the targeted developer.