Justice Department action freezes $2.7 billion in Binance theft

More than $2.7 billion from the $6 billion Binance theft has been frozen. The Justice Department said it obtained court authorization to seize or restrain more than $1.2 billion of that pool.

The $1.2 billion authorization covers part of the larger frozen pool rather than adding a separate recovery. U.S. government agencies and private-sector partners worked with virtual asset service providers to intercept the funds. The FBI, U.S. Secret Service and Internal Revenue Service issued a Cyber Alert asking providers to block transactions involving, or derived from, addresses used to launder the Binance assets.

The Justice Department framed both operations as part of a campaign against cryptocurrency theft used to finance North Korea’s government and illicit weapons program.

How FaceStealer turns meetings into malware

The coordinated action also targeted FaceStealer, a social-engineering scheme separate from the Binance theft. The FBI says FaceStealer stole more than $400 million over 18 months from cryptocurrency and Web3 workers.

Authorities seized cloud infrastructure and recovered more than 900 victim webcam recordings. The U.S. Attorney’s Office for the Central District of California and the FBI’s Los Angeles Field Office led the disruption, acting under a federal warrant.

• Entry: Invitations arrive through fake or hijacked accounts, including accounts taken from earlier victims.
• Impersonation: Attackers use imitation versions of Zoom, Microsoft Teams and Google Meet. They play footage of people the target knows and deepfake videos of influential figures to make the meeting appear legitimate.
• Payload: They claim a technical problem, such as a broken microphone, and offer a link or prompt to repair it. The supposed fix installs malware that gives them access to cryptocurrency, communications accounts and other computer infrastructure.
• Expansion: Stolen contact lists and recordings help attackers approach further victims. In several cases, cryptocurrency theft and account hijacking occur months to more than a year after the initial compromise.

FBI Los Angeles Field Office assistant director in charge Patrick Grandy said: “It exploits our trust in ubiquitous video conference platforms and valued personal relationships.”

The FBI says FaceStealer increasingly targets open-source software developers and maintainers, seeking access to their devices and software repository accounts. Authorities described the apparent objective as enabling software supply-chain attacks.

How the separate Binance theft occurred

The Justice Department attributed more than $6 billion in virtual assets stolen from Binance on or about October 29 to North Korean military members whom the FBI identifies as TraderTraitor. Binance said hackers used fake job interviews. U.S. law enforcement linked the attack to North Korea-linked actors, while Pyongyang denied responsibility. The theft was separate from FaceStealer.

What does this change for crypto and Web3 workers?

The immediate operational change is that video-conference identity and technical-support prompts now have a documented malware pathway. FaceStealer reaches cryptocurrency holdings, communications accounts, developer devices and software repositories by inducing users to install malware, so the exposed control is the decision to install and authorize software during a call.

For practitioners, the relevant question is not only whether a face matches a colleague but whether a meeting request and repair prompt can be independently verified. The FBI’s increasing focus on open-source maintainers raises the consequence of a compromised workstation for downstream software users.

Recovery remains underway

The FBI published a FaceStealer report and created a resource website. Its Los Angeles Field Office, Cyber Division and Virtual Asset Unit jointly handle recovery efforts with the Secret Service and IRS Criminal Investigation, while the separate Binance tracing continues through bridges, mixers and exchanges.

The next operational test is whether providers can block the laundering addresses and prevent traced assets from moving again through bridges, mixers and exchanges. That enforcement window remains open as the interagency team and private-sector partners continue recovery and tracing work.