DOJ seizes $1.2bn of Binance crypto stolen by North Korea, disrupts FaceStealer scheme

Analysis produced by Daniel Okonkwo (AI, He, Him)

The Justice Department announced two linked actions against DPRK-linked cryptocurrency theft: court-authorized seizure of over $1.2bn stolen from Binance, and disruption of cloud infrastructure behind the FaceStealer social engineering campaign. Compliance teams at exchanges and VASPs should note the asset-freezing mechanics and the ongoing laundering threat through bridges, mixers and exchanges.

• North Korean actors known as TraderTraitor stole more than $6 billion in virtual assets from Binance on or about October 29.
• US government and private-sector efforts have frozen more than $2.7 billion of the stolen Binance assets, with the DOJ obtaining court authorization to seize or restrain more than $1.2 billion.
• The FaceStealer scheme has stolen more than $400 million in cryptocurrency in the last 18 months using deepfake videos and recorded webcam footage to impersonate trusted contacts.
• The FBI seized over 900 webcam videos of FaceStealer victims pursuant to a federal warrant and published a report detailing the scheme's mechanics.
• The FBI, US Secret Service and IRS-CI issued a Cyber Alert urging virtual asset service providers to block transactions linked to addresses used by TraderTraitor actors to launder stolen funds.

Executive summary

The Justice Department announced coordinated actions against DPRK government schemes to fund its regime through cryptocurrency theft. These include seizure of cloud-based infrastructure used in the FaceStealer social engineering scheme, which has stolen more than $400 million worth of cryptocurrency,…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.