DOJ Moves on $1.2 Billion in Binance Hack Funds and Hits Deepfake Theft Network

The U.S. Department of Justice (DOJ) announced on Nov. 12 that it had secured court authorization to seize and restrain more than $1.2 billion stolen from Binance, marking a major step in the recovery effort.

In a separate operation, authorities seized cloud infrastructure used by FaceStealer, a North Korean impersonation campaign they link to more than $400 million in crypto theft over 18 months.

Court Orders Cover Part of a $2.7 Billion Asset Freeze

The Federal Bureau of Investigation (FBI) attributes the Binance theft to TraderTraitor, a group it identifies as part of North Korea’s military. Attackers stole more than $6 billion from the exchange around Oct. 29.

Authorities worked with crypto service providers to freeze more than $2.7 billion associated with the theft. The amount covered by the seizure and restraint orders sits within that total, rather than adding another $1.2 billion to it.

The orders give authorities legal tools to take control of assets or prevent their movement. Returning money to victims is a separate stage: DOJ said tracing, seizure and forfeiture efforts were continuing, without announcing a distribution process or repayment date.

Meanwhile, the department said attackers were still moving stolen funds through cross-chain bridges, mixing services and exchanges to obscure their trail.

Familiar Faces Help Sell a Fake Technical Fix

FaceStealer takes a more personal route into victims’ wallets. Invitations arrive through genuine messaging or social-media accounts hijacked from earlier victims, making an approach look like a conversation with someone the target already knows.

The meeting itself takes place on a convincing imitation of a video-call service. Attackers play recordings of familiar people and sometimes use deepfake videos of prominent crypto figures. They also secretly record the new target, collecting material for later impersonations.

Then comes the trap: a supposed microphone problem or another technical fault. Someone posing as a trusted contact offers instructions to fix it, such as installing an update or running a command. Following those instructions installs malware.

Patrick Grandy, who leads the FBI’s Los Angeles field office, described the campaign’s advantage:

“It exploits our trust in ubiquitous video conference platforms and valued personal relationships.”

The FBI seized more than 900 webcam videos of victims under a federal warrant. Its detailed advisory says stolen recordings still account for most of the campaign’s impersonations, despite the growing use of deepfakes.

Stolen Access Can Stay Dangerous Long After the Call

A compromised computer does not always lead to an immediate theft. The FBI described cases in which attackers waited months, or more than a year, before taking cryptocurrency or hijacking communication accounts.

The campaign also targets open-source software maintainers. Access to their development accounts could let attackers insert malicious code into software used by many other people.

For users, the FBI recommends opening the official video-call application and entering a meeting code, rather than following an unfamiliar meeting link. It also advises confirming invitations through another communication channel and refusing requests to paste commands into a terminal to repair a call.

Anyone who suspects a compromise should move crypto to a wallet with a new recovery phrase created on an unaffected device, according to the advisory. Securing messaging accounts and warning contacts also helps stop a stolen identity from becoming the invitation to the next attack.