US targets North Korean crypto schemes and seizes $1.2 billion linked to Binance hack

The investigation into the Binance cyberattack is gaining momentum as US authorities trace stolen funds and uncover further details of North Korean crypto operations.

The US Department of Justice (DOJ) has announced coordinated actions against North Korean cryptocurrency theft operations, including the disruption of a social engineering campaign known as FaceStealer and court-authorised action to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance. The measures target schemes allegedly used by the Democratic People’s Republic of Korea (DPRK) to generate funds for its regime and illicit weapons programmes.

The FaceStealer campaign, which the FBI attributes to North Korean hackers, has reportedly resulted in more than $400 million in cryptocurrency theft over the past 18 months. The operation targets individuals in the cryptocurrency and Web3 sectors through deceptive video meetings involving recordings of trusted contacts and AI-generated deepfakes of influential industry figures.

Victims are then persuaded to install malware disguised as a technical fix, allowing attackers to compromise their devices, steal digital assets and target their professional contacts. The FBI also warned that the campaign increasingly targets open-source software developers, potentially enabling wider software supply-chain attacks.