DOJ Wins $1.2 Billion Binance Court Order, Names FaceStealer

The U.S. Justice Department obtained court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance. The FBI separately seized cloud infrastructure linked to a North Korean social engineering operation it calls FaceStealer.

The Justice Department announced the actions on Nov. 12. Government and private-sector efforts have frozen more than $2.7 billion of the more than $6 billion taken from Binance on or about Oct. 29. The court order covers more than $1.2 billion of the frozen assets. The announcement did not identify the remaining frozen funds as being covered by a court order.

The department’s release did not announce charges against anyone in connection with the Binance theft. It also did not say that a forfeiture judgment had been issued. A seizure or restraint order holds specified property, while forfeiture transfers ownership to the government through a separate legal process.

Binance reported a loss of $6.34 billion in a Nov. 3 findings report. The Justice Department used the broader figure of more than $6 billion and described the theft as the largest recorded breach involving a cryptocurrency exchange.

The FBI identified FaceStealer as a North Korean operation that has targeted people in the cryptocurrency and Web3 industries. The agency estimates that it caused more than $400 million in losses over the past 18 months.

The operation begins with a compromised device or communications account. The attackers search for cryptocurrency wallets and recovery phrases, take control of Telegram or another messaging account, and record the victim on a webcam. They then contact the victim’s associates from the genuine account and invite them to a video call.

The attackers use fake Zoom, Microsoft Teams or Google Meet websites and play a recording of someone the target knows. They claim that the target’s audio is not working and provide an update, script or terminal command to fix the problem. The command can install software that steals browser cookies, records keystrokes and screens, or provides access to the device.

The FBI seized more than 900 webcam videos under a federal warrant. The recordings were used to impersonate victims and their contacts in later attacks. “It exploits our trust in ubiquitous video conference platforms and valued personal relationships,” Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office, said.

In some cases, attackers waited months or more than a year after compromising a device before taking cryptocurrency. The FBI reported that they monitored wallets and acted after balances increased. It advised possible victims to create a new wallet with new recovery phrases on a separate, clean device and transfer their assets there. They should change passwords, end active sessions, enable multifactor authentication and warn contacts about possible impersonation.

The FBI linked the same method to attacks on open-source software maintainers. In one case, an attacker used a fake Teams meeting to compromise a maintainer’s device and tried to add malicious dependencies to a widely used JavaScript library. The attempt was detected before the software was distributed. Maintainers of projects in the JavaScript and Rust ecosystems were also targeted.

A separate FBI alert issued Oct. 31 listed 628 addresses associated with the Binance theft: 608 on Ethereum, 19 on Bitcoin and one on Solana. The agency asked exchanges, decentralized finance services, blockchain infrastructure providers and other virtual asset businesses to block transactions involving those addresses or funds derived from them. The FBI reported that the stolen assets were converted mainly into ether before being moved through decentralized finance and instant-swap services.

The Justice Department identified cryptocurrency theft as a source of funding for North Korea’s government and weapons program. M. Scott Proctor, principal deputy assistant attorney general for national security, said the National Security Division would use available tools “to seize and return North Korea’s ill-gotten gains.” The announcement did not specify how or when the Binance funds would be returned. Binance said on Oct. 31 that it had replenished 98% of the affected assets and set aside funds to cover the loss.

Reviewed and fact-checked by Alex Panasenko on November 13.