The United States government has successfully frozen over $2.7 billion worth of cryptocurrency stolen from Binance, a major event tied to a larger $6 billion theft attributed to North Korean hackers. This decisive action took place on or around October 29, 2026, as reported by the FBI, which quickly linked the massive breach to North Korea.
Legal Measures and Enforcement
Prompted by court orders, US officials have been authorized to seize or hold more than $1.2 billion of these frozen assets. The Department of Justice announced this significant development on November 12, in conjunction with a separate clampdown on a North Korean scam known as FaceStealer. The FBI has pinpointed a group dubbed TraderTraitor as responsible for the Binance breach, connecting the dots to North Korean activities within days of the incident.
Authorities, including the FBI, Secret Service, and IRS Criminal Investigation, have noted a pattern where the culprits convert stolen funds into Ethereum. From there, they use decentralized finance (DeFi) tools and instant swap services to obscure the money’s trail. Collaboration with crypto service providers has been crucial in halting these transactions, demonstrating effective cross-agency and industry cooperation.
Ongoing Threats and Preventive Actions
Despite these efforts, the hackers continue to move funds through various platforms such as bridges, mixers, and exchanges. The FBI has urged service providers to block any transactions associated with the hacker-linked addresses. Binance has assured its customers that their losses were covered using the exchange’s SAFU emergency fund, pointing to a compromised engineer’s laptop as the source of the breach.
While the Binance theft is a major concern, the Justice Department has emphasized the separate nature of the FaceStealer campaign. This scam has reportedly defrauded victims of over $400 million in the past 18 months, with groups like Sapphire Sleet and APT38 implicated in the scheme. The FBI has seized cloud servers and over 900 victim webcam recordings used in these deceptive operations.
Security Recommendations and Future Outlook
FaceStealer typically begins by hijacking accounts on platforms like Telegram, deceiving contacts through fake video calls resembling Zoom or Teams. This tactic involves sending a link that leads to a counterfeit site, where victims are presented with a recorded video that seems genuine. The attackers exploit these interactions to install malware, including cookie stealers and keyloggers, while occasionally employing deepfake technology for further deception.
Given the sophistication of these scams, the FBI advises individuals to participate in calls via official apps using invite codes, keep webcams off until verifying the caller’s identity, and enable multifactor authentication. For those potentially affected, it is recommended to transfer funds to new wallets on secure devices, update passwords, and report incidents to IC3.gov with the keyword “FaceStealer.”
These preventive measures underscore the importance of rapid response in cybersecurity, as demonstrated by the recent freeze of stolen funds. The FaceStealer case highlights how a single convincing video call can lead to significant financial losses, emphasizing the need for continuous vigilance and threat intelligence integration.
