US moves to seize over $1.2 billion of Binance loot as FBI disrupts FaceStealer scam

The US government on Thursday said it obtained court authorization to seize or restrain use of more than $1.2 billion stolen during last month's $6.3 billion Binance heist. The court also allowed the takedown of cloud-based infrastructure used in a Democratic People's Republic of Korea social engineering scheme called FaceStealer, which amassed more than $400 million in the last 18 months.

Binance heist recovery

The FBI previously blamed the $6.3 billion heist on TraderTraitor, a North Korean hacking operation linked to Lazarus Group. Binance said last week that attackers laid the groundwork in June through social engineering during fake job interviews, malware downloads, compromised internal AI tooling, endpoint takeover, and an advanced transaction-authorization method. Since the theft, federal investigators and private-sector partners have helped freeze more than $2.7 billion in stolen assets, and the Justice Department's court authorization covers more than $1.2 billion of that haul.

FaceStealer targets

The scheme involved secretly recorded webcam videos. Victims are typically people working in cryptocurrency and web3 industries, along with open source software developers and maintainers targeted in hopes of accessing software repositories they control as a first step toward supply chain attacks. The FBI said it seized more than 900 webcam videos belonging to these tech workers.

How the scam works

North Koreans send targets an invitation to join a video meeting from hijacked accounts the intended victim may find familiar or credible. The URL directs the victim to a fake Zoom or Teams meeting, where cybercriminals record the target's webcam video while playing a phony prerecorded video of the person who purportedly sent the invite. Sometimes hackers also use deepfake videos of well-known individuals in the cryptocurrency and web3 industries. The victim sees a face on screen without audio and receives text instructions saying the other person cannot hear them and that software must be upgraded for audio to work. Clicking the supposed fix installs cryptocurrency-stealing malware and sends the victim's contact list to the digital thieves.

Attribution

The FBI attributes FaceStealer to Sapphire Sleet, a North Korea-linked group also known as UNC1069, Stardust Chollima, APT38, and BlueNoroff, and widely regarded as a Lazarus Group offshoot. Brett Leatherman, assistant director of the FBI's Cyber Division, said the actors are part of a broader North Korean effort to generate revenue for the regime, steal virtual assets, and gain access to networks and trusted online ecosystems. He said North Korean hackers are increasingly blending cyber intrusion, social engineering, and emerging technologies such as deep fakes to make impersonation efforts more convincing and scalable.

Earlier coverage: North Korean hackers blamed for the $6.3 billion Binance theft

Sources: The Register