Justice Department Moves To Seize $1.2 Billion Stolen From Binance, Warns Of FaceStealer Scam

What Did The Justice Department Announce?

The Justice Department announced two separate actions against North Korea's crypto theft on Nov. 12. The first targets the money stolen from Binance, the world's largest crypto exchange by trading volume. The second shut down online infrastructure used in FaceStealer, a scheme the FBI says has run for at least 18 months and has nothing to do with the Binance theft.

Freezing and seizing aren't the same thing. A freeze locks funds where they sit, done by an exchange or a stablecoin issuer at law enforcement's request. A court-authorized seizure or restraint goes further: a judge has approved the government taking control of the funds or barring anyone from moving them while the case continues.

Assistant Attorney General A. Tysen Duva said the Justice Department's Criminal Division and its partners moved fast enough to "immediately halt about half of this historic breach."

Save This Article

Email this article to yourself

We'll send you a link to "Justice Department Moves To Seize $1.2 Billion Stolen From Binance, Warns Of FaceStealer Scam" so you can read it later, plus The Weekly Ritual, our free newsletter. Unsubscribe anytime.

Email address

Email It To Me

Email me this article and sign me up for The Weekly Ritual. See our privacy policy.

How Much Of The Binance Theft Has Been Recovered?

None of the stolen crypto has been returned yet. The Justice Department says government and private sector efforts have frozen more than $2.7 billion of the more than $6 billion taken, a bit under half. Binance put the loss at about $6.3 billion. Court approval covers more than $1.2 billion so far, and the department says efforts to trace, freeze, seize and forfeit the rest are ongoing.

The FBI attributes the theft to a group of North Korean military hackers it calls TraderTraitor. On Oct. 31, the FBI, the Secret Service and IRS Criminal Investigation said the hackers were converting the stolen assets mostly into ether, and published the wallet addresses involved so exchanges and other crypto services could block them. The Justice Department says the hackers are still moving funds through bridges, mixers and exchanges.

The release doesn't say when or how seized funds would go back to Binance. We're keeping the theft listed as "pending" on our crypto hacks tracker, which shows every major incident and whether customers got their money back, and our Binance review covers where its withdrawals stand.

What Is The FaceStealer Scam?

FaceStealer is a social engineering scheme that turns each victim's webcam video into bait for the next one. The FBI attributes it to North Korean state hackers known by several names, including Sapphire Sleet, BlueNoroff and APT38. Its FLASH alert lays out how it works:

1. A trusted contact reaches out. The hackers hijack a past victim's Telegram, LinkedIn, Slack or Discord account and use it to invite that person's contacts to "catch up" or "talk about investment opportunities." With access to old chats, they can tailor the message.
2. The meeting link is fake. After a normal-looking calendar invite, the target gets a meeting link shortly before the call. It leads to a lookalike address, such as uu01webzoom.us, hosting a copy of Zoom or Teams.
3. Familiar faces appear. The hackers play recorded webcam video of the past victim, and often of other people, so the call looks like a real meeting. They record the new target's webcam from the moment the link is clicked.
4. A fake technical problem. Someone in the call says the target can't be heard and sends a link, an "update" or a command to paste into the computer's terminal. That fix installs malware, including a keylogger, a screen recorder and a backdoor.

The FBI says the hackers sometimes wait months, or more than a year, before draining a wallet, watching for its balance to grow. They also use what the FBI calls "super intelligence" to make deepfake videos of well-known people in crypto, though the scheme still relies mostly on real stolen video. The FBI has set up a FaceStealer page with resources for anyone who thinks they were targeted.

Why Are Software Developers A Target Too?

The same hackers have used FaceStealer against people who maintain open-source software, the free code packages that apps and websites, including many crypto wallets, are built on. Taking over one maintainer's account would let them slip malicious code into a package that millions of people download.

The FBI says that nearly happened earlier this year. A maintainer of a JavaScript library downloaded tens of millions of times a week followed the "fix" in a fake Teams call, and the hackers used that access to add malicious code to the library before it was caught. The FBI says it has seen other attempts against maintainers on NPM, the main JavaScript package registry, and more recently against Rust developers.

What This Means For Your Money

You don't need to work in crypto to be a target. Anyone whose contacts include a hacked account can get an invite. The FBI's recommendations come down to a few habits:

• Join through the app. Open Zoom or Teams yourself and enter the meeting ID instead of clicking a link sent in a chat, especially from someone you rarely talk to.
• Keep your camera off until you can see, hear and talk with the person who invited you.
• Never run code to fix a call. The FBI says not to run a script or paste code into your terminal to update a video app. Close the call and update the app on your own.
• Confirm on a second channel. If an invite arrives on Telegram, check with the person by text or phone.
• Lock down your chat apps with two-factor authentication, login alerts and disappearing messages.
• Keep large balances off your everyday computer. The FBI suggests keeping only small amounts in browser extension wallets, holding larger amounts on a hardware wallet or with an exchange, and never saving a seed phrase on any device.

If you think you were hit, the FBI says to create a new wallet with a new seed phrase on a device you didn't use for the call and move your crypto there right away. Then change your passwords, log out every active session, and warn your contacts and employer. In the US, report it at ic3.gov with the keyword "FaceStealer." Our page on common crypto scams lists where to report in the UK, Canada, Australia and the EU.

FAQ

Will Binance Customers Get Money From The Seizure?

Binance customers don't need to wait for it. Binance pledged to cover all losses from its own funds and said it had replaced about 95% of the affected assets by Nov. 1. The Justice Department hasn't said when or how seized funds will be returned to Binance.

Is Frozen Crypto The Same As Recovered Crypto?

No. Frozen crypto is locked so the hackers can't move it, but it still has to go through a court process before it can be returned to the victim. As of Nov. 12, the Justice Department had court approval to seize or restrain more than $1.2 billion of the more than $2.7 billion frozen.

How Can I Tell If A Zoom Or Teams Link Is Fake?

The safest approach is not to rely on the link at all. Open the official app and type in the meeting ID yourself. FaceStealer's fake links use addresses that look close to the real ones, such as uu01webzoom.us, and often arrive minutes before the meeting starts.

Who Is Behind The Binance Theft And FaceStealer?

The FBI attributes both to North Korea, but to different groups. It says the Binance theft was carried out by members of North Korea's military it calls TraderTraitor, while FaceStealer is run by state hackers also known as Sapphire Sleet and BlueNoroff.