The DOJ said Thursday it has court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance, part of a freeze of more than $2.7 billion that officials said halted about half of North Korea’s October exchange heist.
In a Thursday announcement, the department said that on or about Oct. 29, members of the North Korean military, referred to by the FBI as TraderTraitor, stole more than $6 billion worth of virtual assets from Binance. That is below the $6.34 billion figure Binance has covered since the attack.
Binance said it had completed coverage of the assets hit in the breach, replacing the tokens from company funds rather than by recovering the stolen coins. Those are separate tracks: the DOJ is trying to interdict what was taken, while the exchange has said users were made whole from its Secure Asset Fund for Users, a portion of its futures insurance fund and its treasury.
Assistant Attorney General A. Tysen Duva of the DOJ’s Criminal Division said the department and its partners were able to “immediately halt about half of this historic breach” by freezing stolen assets “before they got beyond law enforcement reach.” The freeze of more than $2.7 billion is a joint figure for U.S. government and private-sector efforts. Of that amount, the DOJ said it has already obtained court authorization to seize or restrain more than $1.2 billion. The underlying court papers were not posted with the announcement.
The $1.2 billion is not newly recovered money but comes out of the roughly $2.85 billion Binance said on Nov. 3 had been frozen or intercepted, and Thursday’s court authorization is the legal step that lets the government move toward taking ownership of those funds through forfeiture, where until now they had simply been frozen at the token issuers.
Even that freeze is not the end of the trail. The DOJ said TraderTraitor actors are still moving the stolen assets through cryptocurrency bridges, mixers and exchanges, and that tracing, seizure and forfeiture work continues. Last week, on Oct. 31, the FBI, with the U.S. Secret Service and IRS Criminal Investigation, issued a Cyber Alert attributing the theft to North Korea and urging virtual asset service providers to block transactions with or derived from addresses the actors are using. The alert said investigators have seen the stolen assets converted primarily into ether.
A separate $400 million deepfake scheme, and 900 seized videos
Separately from the DOJ and Binance case, the U.S. attorney’s office in the Central District of California and the FBI announced the seizure of cloud-based infrastructure used in a social engineering campaign the FBI is calling FaceStealer. The FBI said the scheme has resulted in the theft of more than $400 million in cryptocurrency over the last 18 months and has also been used in attempts to compromise people who maintain open-source software, a step the bureau said appears calculated to enable supply-chain attacks.
The method is a fake video call. The FBI said North Korean hackers, known publicly under names including APT38 and BlueNoroff, lure targets with meeting invitations sent from accounts stolen from earlier victims. Once a target joins, the hackers play a prerecorded webcam video of a person the target knows, or a deepfake of a well-known figure in the cryptocurrency industry, then introduce a fake technical error and send a “fix” that installs malware. In several cases, the theft came months to more than a year after the first compromise, as the hackers waited for wallet balances to grow.
A Thursday FBI FLASH report said the meetings run on imposter versions of Zoom, Microsoft Teams and Google Meet, with invitations often moving through hijacked Telegram, LinkedIn, Slack or Discord accounts. Pursuant to a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims. The bureau has posted a hub for the campaign at fbi.gov/facestealer.
Principal Deputy Assistant Attorney General for National Security M. Scott Proctor tied both Thursday’s actions to the same charge: “North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft.”
The Binance recovery is still being run by the FBI’s Los Angeles Field Office, Cyber Division and Virtual Asset Unit, with the Secret Service and IRS-CI. The DOJ did not say how much of the more than $2.7 billion freeze, or of the $1.2 billion under court authority, is bitcoin.