"Before they got beyond law enforcement reach," A. Tysen Duva said, the Justice Department froze stolen assets — a move he called halting "about half of this historic breach." Duva, the assistant attorney general in charge of the DOJ’s Criminal Division, was describing coordinated actions that dismantled cloud infrastructure used in a widespread social‑engineering scheme and secured court authorization to seize more than $1.2 billion traced to a larger North Korean‑linked theft from Binance.
TraderTraitor and the Binance theft: scale, freezes, and seizures
The Department of Justice and FBI tied the larger operation to the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance, an operation U.S. investigators have attributed to North Korean military hackers they call TraderTraitor. Working with private virtual asset service providers, investigators have frozen more than $2.7 billion of the stolen funds; courts have authorized the seizure of more than $1.2 billion of that frozen amount.
Duva framed the seizure as stopping the stolen Binance assets "before they got beyond law enforcement reach," and said the action halted "about half of this historic breach." Bill Essayli, a U.S. attorney for the Central District of California, added the seizure demonstrates that "America will continue the fight against rogue states who financially gain from cybercrime."
FaceStealer: hijacked meetings, typo‑squatted domains, and 900+ recorded videos
The FBI announced it had seized cloud infrastructure behind a social‑engineering scheme known as FaceStealer. According to an alert accompanying the announcement, hackers publicly known as Sapphire Sleet, BlueNoroff, APT38 and Stardust Chollima hijack accounts on Telegram, LinkedIn, Slack and Discord and invite targets to video meetings. Links lead victims to typo‑squatted domains that host imposter versions of Zoom and Microsoft Teams "designed by the hackers to be indistinguishable from the genuine interfaces."
Within that infrastructure, investigators found a library of more than 900 secretly recorded webcam videos that the hackers used to impersonate victims in follow‑on attacks; the footage was captured from victims as they waited for video chats to begin. The FBI said it has seized more than 900 victim videos and published redacted, blurred examples in its alert. The bureau warned that each compromise yields the next victim’s video and contact lists, allowing the pool of targets and victims to "grow exponentially."
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadMechanics shown in the FBI alert: deception that bypasses technical savvy
The FBI detailed how the scheme capitalizes on trusted collaboration platforms and personal relationships. Patrick Grandy, the assistant director in charge of the FBI’s Los Angeles field office, warned the scheme is "capable of deceiving even the most experienced technical and security conscious computer user," because it exploits "our trust in ubiquitous video conference platforms and valued personal relationships."
The alert describes a stepwise playbook: account hijack, invitation to a video meeting, redirection to a spoofed meeting portal, covert capture of webcam footage, and reuse of that footage to authenticate future impersonations. The FBI linked the same mechanics to multiple thefts that have drained more than $400 million from the cryptocurrency and Web3 sectors over the past 18 months.
Supply‑chain implications: the open‑source JavaScript maintainer incident
The alert included a concrete example beyond direct cryptocurrency theft: earlier this year the campaign lured the maintainer of a significant open‑source JavaScript library into a fake Teams meeting. Using the maintainer’s access, the hackers created malicious dependencies that could have been downloaded alongside legitimate ones, demonstrating how FaceStealer's social tactics can extend into software supply‑chain compromise.
How technologists, policymakers, and end users are responding
- Technologists and security teams: Expect renewed focus on vetting external meeting links, monitoring typo‑squat domains, and scanning dependency trees for unauthorized changes — especially after the open‑source maintainer compromise. The FBI credited Arctic Wolf, Jumpsec and Microsoft Threat Intelligence Center with assisting the investigation and seizure, signaling continued public‑private operational cooperation.
- Policymakers and prosecutors: The DOJ’s combination of criminal computer‑crime resources and court‑authorized seizures demonstrates a legal pathway to disrupt state‑linked cyber thefts by following and freezing virtual asset flows; the seizure of more than $1.2 billion represents a concrete application of that approach.
- End users and maintainers of online projects: The campaign shows how routine behaviors — clicking meeting links, answering invites from known contacts, or maintaining widely used libraries — can be weaponized. The FBI’s depiction of imposter meeting interfaces and reused webcam footage underscores the limits of relying solely on perceived familiarity.
The coordinated action combined traditional law enforcement tools — court seizures and asset freezes — with technical takedowns of cloud infrastructure and industry collaboration. The result: more than $2.7 billion of frozen crypto, courts authorizing the seizure of over $1.2 billion, and a seized FaceStealer library of more than 900 victim videos. Yet the DOJ framed this as part of ongoing disruption: Duva said the moves stopped roughly half of the Binance breach, and the FBI’s alert emphasized that the campaign's exponential victim-growth model remains a powerful force. The immediate question the record leaves is operational: how rapidly and completely remaining stolen funds and active infrastructure can be located and neutralized as attackers evolve their tactics.
https://cyberscoop.com/us-seizes-north-korea-hacking-infrastructure-binance/
