U.S. authorities have recovered approximately $1.2 billion in cryptocurrency stolen from Binance last month, according to a statement from the Department of Justice on Thursday. The theft, which occurred on October 29, involved over $6 billion in virtual assets and was linked to actors associated with the North Korean military. The FBI has identified these hackers as "TraderTraitor." The DOJ emphasized its commitment to combating cybercrime schemes used by North Korea to fund its regime.
The coordinated efforts between U.S. government agencies and private sector partners have so far frozen more than $2.7 billion of the stolen funds. However, the FBI noted that the hackers continue to launder the assets through various cryptocurrency channels, making the recovery process ongoing. The DOJ also seized cloud-based infrastructure used in a separate scam called "FaceStealer," which has stolen over $400 million in cryptocurrency over 18 months.
FaceStealer involves hackers setting up fake video meetings using stolen accounts and AI-generated deepfakes. They then trick victims into installing malware, allowing them to take over communications, steal cryptocurrency, and target the victim's contacts. Assistant Director in Charge Patrick Grandy of the FBI's Los Angeles Field Office described FaceStealer as "a highly effective social engineering scheme capable of deceiving even the most experienced technical and security-conscious computer user."
Principal Deputy Assistant Attorney General for National Security M. Scott Proctor stated that North Korea's government funds its illicit activities through cryptocurrency theft. He affirmed that the U.S. will use all available tools to seize and return the stolen assets.