The US Justice Department has obtained court authorization to seize or restrain more than $1.2 billion of the roughly $6.3 billion stolen from Binance, and the FBI separately disrupted cloud infrastructure behind FaceStealer, a North Korean fake-meeting scheme that stole over $400 million in 18 months. Both actions were announced on November 12.
Tracing the Binance Theft to TraderTraitor
The Binance theft occurred on October 29, and the FBI attributes it to North Korea’s TraderTraitor cluster. Outlets reported totals between $6 billion and $6.43 billion. The $1.2 billion seizure order comes out of about $2.7 billion that exchanges and partners have already frozen.
Elliptic’s analysis describes a large laundering effort: more than 20,000 wallets across 16 blockchains, over 36 services and more than 65,000 transactions. The launderers also minted worthless NEAR meme coins to muddy the flow of funds. Elliptic says about $3.0 billion remains in linked addresses, and exchanges have been asked to block the wallets the government listed.
Why the Seizure Total Falls Short of the Theft
Of the stolen amount, $1.2 billion in court-authorized seizures represents only a fraction of the haul. The rest is split between frozen funds and the roughly $3.0 billion Elliptic still tracks in linked addresses, so recovery depends on continued cooperation from exchanges rather than a single order.
FaceStealer: Fake Zoom Calls With Recorded Victim Video
In a related action, the FBI disrupted the cloud infrastructure used by FaceStealer. The operators, tracked under names including Sapphire Sleet, BlueNoroff, APT38 and Stardust Chollima, take over Telegram, LinkedIn, Slack and Discord accounts, then invite targets to fake Zoom or Teams calls hosted on lookalike domains.
How the Fake Audio Error Installs Malware
During the call, the scammers play recorded webcam footage of earlier victims to make the meeting look real. A staged audio error prompts the target to run a command, which installs cookie stealers, keyloggers, a screen capturer and a backdoor. The FBI seized more than 900 recorded victim videos.
Operators sometimes waited months, and in some cases more than a year, before draining a victim’s wallets.
Open-Source Maintainers in the Crosshairs
The campaign reached beyond crypto workers. An open-source JavaScript library maintainer, whose package draws tens of millions of weekly downloads, was lured earlier this year, and the attack was stopped. Maintainers of npm packages and Rust crates were also targeted, which raises the risk that a compromised developer could be used to push malicious code into widely used software.
FBI, Secret Service and IRS-CI Joint FaceStealer Alert
The FBI, Secret Service and IRS Criminal Investigation issued a joint alert, with guidance at fbi.gov/facestealer. The Binance theft is cited as the largest crypto heist in the coverage of this action, and the FaceStealer losses add more than $400 million.
The two actions show North Korean operations running on two tracks at once: large-scale exchange compromise and patient, one-by-one social engineering of individuals. The social engineering feeds the larger operation because credentials, session cookies and wallet access taken from individual workers can lead into the corporate and exchange systems that hold far more money.
For exchanges, the seizure order puts pressure on rapid wallet-blocking and freezing, the same cooperation that already immobilized about $2.7 billion. For open-source ecosystems, the targeting of npm and Rust maintainers means account takeover of a single volunteer can have effects well beyond that person.
What the Two Actions Mean for Exchanges and Developers
The FBI’s joint alert with the Secret Service and IRS Criminal Investigation widens the audience beyond exchanges to ordinary crypto workers, who are the people FaceStealer’s operators contact through hijacked messaging accounts. The seized recordings of more than 900 victims also give investigators a record of how the fake calls were staged and who was on the receiving end.
Pressure on Exchanges to Block Listed Wallets
Exchanges have been asked to block the wallets named in the government’s listing. Because Elliptic’s tracing shows funds moving across 16 blockchains and through more than 36 services, the effectiveness of that request depends on how many platforms act quickly on the same list.
