The U.S. Justice Department said on Thursday that it has won court approval to seize or restrain more than $1.2 billion in cryptocurrency stolen from the Binance exchange, in what officials called the largest crypto theft on record. In the same announcement, the FBI exposed a separate North Korean scheme, dubbed "FaceStealer," that used fake video calls and deepfakes to steal more than $400 million over 18 months.
 |
| File photo: The J. Edgar Hoover Building, the FBI headquarters in Washington, D.C. |
The Justice Department's announcement, made on November 12, marked the most significant public action yet against the North Korean hacking campaign behind the theft. Federal prosecutors said the funds were taken on October 29, when hackers drained more than $6 billion in virtual assets from Binance, the world's largest cryptocurrency exchange. Binance itself put the loss at about $6.34 billion.
According to the department, government and private-sector efforts have now frozen more than $2.7 billion of the stolen money. The $1.2 billion covered by the court authorization is part of that frozen total. The authorization is a seizure and restraint order, not a completed forfeiture, and court proceedings continue. No individual was named or charged in connection with the October 29 theft in Thursday's announcement.
 |
| Illustrative photo: Physical Bitcoin coins. The Justice Department says more than $6 billion in cryptocurrency was stolen from Binance on October 29. |
The $6 Billion Heist
The theft from Binance on October 29 is the largest cryptocurrency theft ever recorded, according to blockchain intelligence firm TRM Labs. It surpassed the previous record, the roughly $1.5 billion Bybit hack in February 2025.
Analytics firm Elliptic has tracked about $6.43 billion across more than 20,000 wallets, while Binance said in a findings report published on November 3 that the loss stood at $6.34 billion. Binance said on October 31 that 98 percent of the affected assets had been replenished.
The FBI attributes the theft to TraderTraitor, a North Korean military hacking unit also tracked as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.
On October 31, the FBI, the U.S. Secret Service and the IRS's criminal investigation division issued a joint cyber alert attributing the theft and publishing a list of 628 cryptocurrency addresses the actors were using.
The Justice Department said its National Security Division and computer crime section, with the U.S. Attorney's Office for the District of Columbia, worked with virtual asset service providers to intercept the funds as the hackers tried to move them.
A Second Scheme: Fake Faces on Video Calls
The second action announced on Thursday targeted a different kind of crime. The FBI said it had seized cloud-based infrastructure behind a social engineering scheme it calls FaceStealer, which it says has stolen more than $400 million in cryptocurrency over the past 18 months.
FaceStealer did not rely on breaking into exchanges. It relied on trust. According to the Justice Department, the hackers began by compromising one victim, then used that person's accounts to invite the next target to a video meeting, with an invitation that arrived from a real contact, on a real-looking link, to what appeared to be a Zoom or Microsoft Teams call.
Once the target joined, the trap closed in stages. The hackers secretly recorded the target's own webcam video, footage they would later reuse against the next victim. On screen, they played a prerecorded video of a previous victim, or of someone the target knew, simulating the participation of a trusted contact. In some cases they went further, using artificial intelligence to build deepfake videos of well-known figures in the cryptocurrency and Web3 industries.
The hackers also took over victims' Telegram, LinkedIn, Slack and Discord accounts, read their chat histories, and tailored invitations to past conversations. The meeting link, often sent through scheduling services such as Calendly, looked like Zoom or Teams but pointed to a lookalike domain, such as uu01webzoom.us, built to imitate the real service.
Then came the hook. Partway through the call, the hackers claimed the target could not be heard, or that the audio was broken, and offered a fix: a link, a download, or a set of troubleshooting commands to run. Following those steps quietly installed malware on the target's computer.
The Malware Behind the Smile
According to the FBI, the tools installed by the fake fix included a browser cookie harvester, keyloggers, a screen capturer and a backdoor into the victim's machine, giving the hackers access to the victim's computer, communication accounts and cryptocurrency wallets.
The FBI said the scheme aggressively targeted people and companies in the cryptocurrency and Web3 sectors, as well as developers maintaining widely used open-source software. The attackers mined contact lists, social media and messaging apps, and in some cases struck months, or more than a year, after the first compromise. Every successful call fed the next one: a victim's webcam was recording from the moment they clicked the meeting link, and that footage became the familiar face played to the next person on their contact list. The bureau said it seized more than 900 webcam videos of victims under a federal warrant.
FBI Cyber Branch Operations Director Brett Leatherman said the hackers had aggressively targeted people in the crypto and Web3 sectors, and pledged to keep "imposing cost on North Korean actors."
The FaceStealer disruption was led by the FBI's Los Angeles Field Office and the U.S. Attorney's Office for the Central District of California. The FBI also published a report on how the scheme works, with protective steps and advice for victims, and set up a resource hub at fbi.gov/facestealer. Its alert on the scheme, FLASH number AC-111226-MS, was published on November 12.
Why North Korea Steals Crypto
The Justice Department said both actions target what federal officials describe as North Korea's practice of financing its government through cryptocurrency theft. The department said the coordinated actions are aimed at disrupting schemes operated by the North Korean government to generate revenue through crypto theft.
North Korean state-backed hackers have spent years turning stolen cryptocurrency into one of the regime's most reliable sources of foreign currency, according to U.S. officials. Because the country is heavily sanctioned and largely cut off from global banking, digital assets that can be moved across borders have become a central tool for funding its weapons programs.
The scale of the Binance theft shows how far that enterprise has grown. A single intrusion in October took more than four times the value of the previous record theft, and the follow-up operation has required an unusually broad response, involving the Justice Department, the FBI, the Secret Service, the IRS, and private exchanges and blockchain firms.
What This Means
Thursday's announcement is a rare public win for U.S. law enforcement against a hacking campaign that has mostly operated in the shadows. Freezing more than $2.7 billion of the Binance haul, and winning court authority over $1.2 billion of it, shows that the money can be traced and stopped even after it has been scattered across thousands of wallets.
But the announcement also carried a warning. The $1.2 billion under court order is only part of the more than $6 billion stolen, and about $1.5 billion that has been frozen is not yet covered by a court order. The department said it would "seize and return" the funds, but the path for returning them is still being built, and no forfeiture judgment has yet been entered.
For the cryptocurrency industry, the message is that the threat now comes in two forms at once: the large-scale exchange hack, and the one-to-one deception aimed at individual workers — both run, according to U.S. officials, by the same state-backed apparatus, and both depending on the same weakness: trust.
 |
| Illustrative photo: A laptop showing a video conference call with a webcam. In the FaceStealer scheme, hackers used fake video calls to trick victims into installing malware. |
What Happens Next
Court proceedings over the seized cryptocurrency will continue, with the Justice Department seeking forfeiture and working out how the funds will be returned. Investigators are still tracing the remaining stolen assets, and further seizures are possible.
The FBI's FaceStealer guidance is now public, and the bureau is urging crypto and Web3 workers and open-source developers to check whether they were targeted. Its resource hub at fbi.gov/facestealer includes the bureau's report on the scheme and steps for victims.
Whether the disruption slows North Korea's crypto theft campaign remains an open question. U.S. officials have disrupted similar operations before, only for the groups behind them to reappear under new names. For now, Thursday's announcement stands as the largest single recovery effort in the history of cryptocurrency crime, and as a public unmasking of one of the most deceptive schemes the FBI says it has seen.
Sources: U.S. Department of Justice press release 26-1356 (November 12, 2026); FBI FaceStealer guidance and FLASH alert AC-111226-MS; New York Post; ITWeb; The Cyber Express; Help Net Security; Cryptopolitan; The Record.
Post a Comment