DOJ moves to seize $1.2 billion from Binance hack, disrupts North Korean deepfake scheme

The U.S. Department of Justice has obtained court approval to seize or restrain more than $1.2 billion stolen from crypto exchange Binance and disrupted a separate North Korean scheme that used fake video calls to steal crypto.

The Binance funds are part of more than $2.7 billion frozen through efforts by U.S. authorities and private companies, the DOJ said Thursday. Investigators are still tracing stolen assets as the hackers move them through crypto bridges, mixers and exchanges, the department said.

The DOJ attributed the Binance hack to North Korean military hackers known as TraderTraitor. The group stole more than $6 billion from the exchange around Oct. 29, according to the department.

"North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," said Principal Deputy Assistant Attorney General for National Security M. Scott Proctor. "The National Security Division will use every tool at its disposal to seize and return North Korea's ill-gotten gains."

Binance previously put its losses at about $6.3 billion and set aside $6.34 billion in company funds to cover them. Earlier Thursday, Binance said it has completed coverage of assets impacted in the hack and published a new proof of reserves snapshot.

DOJ seizes FaceStealer deepfake video-call infrastructure

Separately, the DOJ said it seized cloud infrastructure used in a North Korean campaign the FBI calls FaceStealer. The scheme has led to more than $400 million in crypto theft over the past 18 months, the department said.

Hackers used stolen accounts to invite victims to video calls, where they played recordings or deepfakes of familiar people. They then faked technical problems and tricked victims into installing malware that could steal crypto or access other systems, the DOJ said.

"It exploits our trust in ubiquitous video conference platforms and valued personal relationships," said Patrick Grandy, assistant director in charge of the FBI's Los Angeles Field Office. "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."

In some cases, the theft and takeover of communication accounts happened months to more than a year after the computer was first compromised, the department said.

Hackers also used stolen contacts and accounts to target more people, including open-source software developers, potentially to carry out attacks through their software. The FBI seized more than 900 webcam videos of FaceStealer victims and issued guidance for those affected, the DOJ said.