US seizes $1.2 billion stolen from Binance and disrupts North Korea's "FaceStealer" fake video-call scheme

The Justice Department announced on Thursday that it had obtained court authorization to seize or restrain more than $1.2 billion of the roughly $6.3 billion stolen from cryptocurrency exchange Binance last month. Binance and the FBI attribute that theft to the North Korean group TraderTraitor. Crypto platforms and the government have frozen more than $2.7 billion of the stolen funds so far. Assistant Attorney General A. Tysen Duva said the quick freeze halted "about half of this historic breach." The department says tracing and seizure efforts are continuing while the attackers launder funds through bridges, mixers and exchanges. In a separate action, US authorities seized cloud infrastructure behind FaceStealer. The FBI attributes this social-engineering scheme to North Korean hackers tracked as Sapphire Sleet, BlueNoroff and APT38, and says it has stolen more than $400 million in cryptocurrency over 18 months. The attackers take over victims' messaging accounts and invite their contacts to fake Zoom or Teams calls on lookalike domains. In those calls they play recorded webcam footage of earlier victims, then claim there is an audio problem so the target will install malware. The FBI seized more than 900 of these recordings and on November 12 warned crypto and web3 workers and open-source maintainers about the scheme.