Justice Department seizes $1.2 billion tied to Binance theft, disrupts FaceStealer

On November 12, 2026, the Justice Department secured court authorization to permit seizure of more than $1.2 billion removed from Binance and to freeze those funds. The October 29, 2026 intrusion took about $6.3 billion in virtual assets from the exchange, and the FBI blamed TraderTraitor, a North Korean hacking crew. The Justice Department said officials and private-sector partners froze more than $2.7 billion from the Binance theft pot, and the $1.2 billion covered by court orders sits inside that frozen pile rather than adding to it. A. Tysen Duva said those partners “played the critical role in immediately freezing billions of dollars’ worth of stolen Binance digital assets before they got beyond law enforcement reach.” The FBI and Justice Department took down FaceStealer cloud infrastructure connected to a North Korean campaign that the FBI said stole more than $400 million in cryptocurrency over 18 months. The trick relied on fake video calls and malicious software. Invites came as Calendly links to Zoom or Microsoft Teams calls from hijacked earlier-victim accounts, and the links led to lookalike domains pretending to be those platforms. During the call, attackers claimed they could not hear the target and offered a remedy link that quietly added tools to steal cookies, log keystrokes, capture the screen and open a backdoor. The assailants taped each victim’s webcam and replayed earlier victims’ tapes to make the calls seem real. Jeremy Robertson of the FBI’s Los Angeles Field Office called the trick unpatchable and highly convincing, saying, “This is not something we can patch.” The crooks lifted cryptocurrency, took over Telegram, LinkedIn, Slack and Discord accounts, and used stolen chat histories to send tailored messages to the victim’s high-value contacts. Under a federal warrant, the FBI seized more than 900 webcam videos from FaceStealer victims, building a library used to pretend to be those people in later attacks. The effort aimed at cryptocurrency and Web3 workers — Web3 is the blockchain-based internet stack — and, increasingly, open-source software developers and maintainers. North Korean actors also targeted people who maintain code repositories on NPM and on Rust crates; NPM is the JavaScript package registry. And earlier this year they almost fooled a maintainer of a big open-source JavaScript library into a sham Teams session. The actors wanted entry to devices and software-repository accounts so they could poison the software supply chain. The FBI cautioned that attackers who reach a developer’s machine or repository account could push harmful code through common software to reach many users downstream. They abused a compromised maintainer’s entry to an open-source JavaScript library to post malicious dependencies that might download alongside real packages. In several cases, the theft and the account takeover showed up months to more than a year following the initial break-in, giving the attackers time to build trust. Each new break-in adds another victim’s video and contact list, so the pool of targets expands exponentially with every intrusion. Sometimes the attackers used artificial intelligence to build deepfake videos of prominent cryptocurrency figures, which made the bogus meetings more persuasive. Patrick Grandy, who works in the FBI’s Los Angeles office, said FaceStealer can deceive even careful security-conscious computer users, and he said, “It exploits our trust in ubiquitous video conference platforms and valued personal relationships.” Binance said the intruders got onto an engineer’s computer using a sham job interview before reaching the systems that approve cryptocurrency transfers. Richard Teng, Binance co-chief executive, said the exchange found more break-in points, meaning the attack had more than one person behind it. APT38, a North Korean military group tied to the 2016 Bank of Bangladesh theft, was linked to FaceStealer and to earlier poisoned NPM packages. The Justice Department said the intruders use many aliases, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. Michael Barnhart of DTEX said TraderTraitor broke away from APT38 into separate pieces after APT38 succeeded. He also said TraderTraitor rapidly moves stolen cash to Chinese money launderers for a lump sum or a cut. TraderTraitor actors keep shifting stolen crypto through bridges, mixers and exchanges while tracing and forfeiture continue. The FBI warning from October 31, 2026 said the stolen assets mainly became Ether and predicted more laundering through decentralized finance and instant-swap services. Elliptic said North Korean money launderers made worthless tokens for moving stolen digital currency through decentralized exchange liquidity pools without moving directly from one wallet to another. North Korea used a comparable method last year to launder $1.4 billion taken from Dubai-based Bybit. Brett Leatherman, an FBI official, said North Korea pays for an illegal weapons program with cryptocurrency theft money. M. Scott Proctor said the North Korean government funds its rogue regime and illegal weapons program through cryptocurrency theft. For years, North Korea has mixed cryptocurrency thefts with a plan to put remote technology workers at American businesses to launder money and dodge sanctions. Officials said the Binance job and the FaceStealer job probably involved different North Korean crews, handling separate phases of North Korea’s cryptocurrency theft work. A senior Justice Department official said that the government keeps custody of the seized money and that giving it back would require court hearings to decide who owns it. SecurityWeek reported that a judge decides who can rightfully claim recovered funds after a forfeiture claim is filed. The official added that recovering more of the stolen Binance money is growing harder because the attackers split it into smaller amounts and spread it through laundering networks. The FBI said that Arctic Wolf and Jumpsec along with Microsoft Threat Intelligence Center helped with the investigation and the seizure. The Justice Department’s National Security Division’s National Security Cyber Section worked with virtual asset service providers to intercept stolen Binance assets, as did the Criminal Division’s Computer Crime and Intellectual Property Section and the U.S. Attorney’s Office for the District of Columbia. Recovery is coordinated by the FBI’s Los Angeles Field Office along with its Cyber Division and Virtual Asset Unit, together with the U.S. Secret Service and IRS Criminal Investigation. On October 31, 2026, the FBI asked firms that move digital currency, including node operators, blockchain analysts, DeFi services and instant exchanges, to block transactions tied to those addresses. Arctic Wolf found more than 677 targets in 58 countries over half a year. Nextgov described FaceStealer’s malicious fix steps as possibly involving a script or terminal commands instead of actually repairing audio. The FBI said attackers broke into a developer’s computer, inserted harmful code into popular software, and halted the attack before it spread broadly. An FBI agent said it is not clear whether FaceStealer played any part in the Binance break-in. Jeremy Robertson said earlier conversations let attackers make their messages sound familiar. Justin Moore, of Arctic Wolf, said North Korean social engineering keeps changing while the goal stays the same. The FBI has talked to many FaceStealer victims without finding the first victim.