By Olivia Hart

The Justice Department said on Thursday that federal authorities have frozen more than $2.7 billion in cryptocurrency linked to North Korea’s $6.3 billion theft from Binance. The agency also obtained court authorization to seize or restrict access to more than $1.2 billion in stolen funds, while investigators continue tracking the proceeds.

What has the DOJ secured?

The action combines an asset freeze with court-backed controls on stolen cryptocurrency. It also targets two enforcement problems: recovering billions taken from Binance and dismantling a separate hacking operation aimed at cryptocurrency holders and software developers.

How did the Binance attack begin?

The theft occurred around Oct. 29 and targeted Binance, one of the world’s largest cryptocurrency exchanges. Preliminary findings indicated that hackers may have entered through a compromised company computer and initiated unauthorized transfers of cryptocurrency.

Investigators attributed the theft to members of the North Korean military, part of an operation the FBI calls “TraderTraitor.” Authorities continue tracking the cryptocurrency as hackers try to move it through digital exchanges and services that can make transactions harder to trace.

“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” Principal Deputy Assistant Attorney General for National Security M. Scott Proctor said. “Today’s announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime.”

“The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.” His statement makes asset recovery a stated objective of the division’s enforcement work.

How does FaceStealer operate?

The FBI separately announced that it had seized online infrastructure used by North Korean hackers in a scheme called “FaceStealer.” Investigators said the operation has stolen more than $400 million in cryptocurrency over the past 18 months.

FaceStealer uses fake video meetings to trick victims into downloading malicious software that gives attackers access to their computers. Its four-stage chain begins with account access and ends with further account takeover:

• Hackers first take control of an online account and use it to invite other people to video meetings.
• During the calls, they use prerecorded footage or AI-generated videos to impersonate people the victim knows and trusts.
• They then invent a technical problem and persuade the victim to download software presented as necessary to fix it.
• The substitute software steals cryptocurrency, accesses personal information, and lets attackers take control of additional accounts.

The scheme increasingly targets developers who build and maintain open-source software, a body of publicly available computer code that other developers can use. Compromising those accounts gives attackers a route to spread malicious software to additional users, extending the risk beyond cryptocurrency into the open-source software supply chain.

Federal investigators have seized more than 900 webcam videos of victims as part of the investigation. The FBI has also launched a website with information about FaceStealer and guidance for possible victims.

“North Korea’s FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user,” Assistant Director in Charge Patrick Grandy of the FBI’s Los Angeles Field Office said. “It exploits our trust in ubiquitous video conference platforms and valued personal relationships.”

“If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough. The FBI is sounding the alarm to elevate awareness of this growing scheme, now aimed not only at crypto theft, but also the exploitation of the open-source software supply chain.” The warning extends the operation’s significance beyond stolen funds.

What changes for exchanges and developers?

That changes the operating risk. For cryptocurrency exchanges, the enforcement test is whether asset freezes and court restrictions can stay ahead of attempts to route the Binance proceeds through other digital services.

For software developers, the FBI warning makes video-call identity and software downloads central security checks. A compromised account can supply trusted invitations, while an impersonated colleague can make malicious software appear routine.

FaceStealer works like a chain reaction: one hijacked account supplies contacts, a familiar face supplies credibility, and a manufactured fault pushes the victim toward malware. That chain explains why developer identity compromise matters beyond one account, because malicious software can spread to additional users through open-source projects.