DOJ Targets $1.2b from Binance Hack, Disrupts Facestealer

The US Division of Justice stated Thursday it had obtained courtroom authorization to grab or restrain greater than $1.2 billion of the $6.3 billion in cryptocurrency stolen from Binance.

The authorization covers a part of the greater than $2.7 billion in stolen belongings that US authorities and private-sector companions have frozen for the reason that Oct. 29 hack. Investigators are nonetheless working to recuperate further funds, the division stated in its announcement.

The FBI attributed the Binance hack to North Korea’s TraderTraitor group in a cyber alert. Kim Yo Jong, the sister of North Korean chief Kim Jong Un, denied North Korea’s involvement.

Binance stated it had lined the affected belongings with its personal funds and {that a} new proof-of-reserves snapshot confirmed no less than one-to-one backing for buyer belongings, in keeping with its Thursday post on X.

In November 2025, the DOJ introduced a separate enforcement action focusing on about $15 million in cryptocurrency linked to North Korean hackers often called APT38.

Associated: Crypto hack losses equal 57 cents per $1 earned onchain: Ark’s Valente

FBI warns of FaceStealer’s deepfake video calls

In a separate case, US authorities seized cloud infrastructure utilized in FaceStealer, a North Korean social engineering marketing campaign that stole greater than $400 million in cryptocurrency over the previous 18 months, the DOJ stated.

The hackers used secretly recorded footage of earlier victims and AI-generated deepfakes of distinguished crypto figures to achieve targets’ belief on video calls. They used bogus technical fixes to trick targets into putting in malware, the DOJ stated.

The marketing campaign focused individuals working in crypto and Web3. The hackers additionally more and more focused open-source software program builders and maintainers in makes an attempt to achieve entry to their units and software program repository accounts.

The FBI seized greater than 900 webcam movies of FaceStealer victims beneath a federal warrant. The bureau additionally revealed steerage on learn how to defend in opposition to the scheme and what to do after a compromise in a public advisory.

Redacted stills from webcam movies recorded by FaceStealer hackers. Supply: FBI

The DOJ stated the hackers behind FaceStealer are identified publicly by a number of names, together with Sapphire Sleet, UNC1069, Harmful Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.

Journal: THORChain founder rejects freeze request, CZ thanks Secret Service: Hodler’s Digest