DOJ seizes about $1.2B from Binance heist as FBI cites "TraderTraitor"

What happened

On Thursday, the Justice Department said it is pursuing coordinated steps against what it described as North Korea's efforts to fund its regime by stealing cryptocurrency, including a court approved seizure of more than $1.2 billion tied to the recent Binance breach. The Oct. 29 theft exceeded $6 billion, and investigators say more than $2.7 billion has been locked down.

The FBI points to North Korean military operators it refers to as "TraderTraitor" as responsible for the attack. Justice Department teams, partner agencies and crypto service providers have been working together to block and retrieve the assets, while tracking continues as those actors attempt to move funds through multiple crypto channels.

How FaceStealer works and who it targets

Officials also said they seized cloud-based systems used for the FaceStealer campaign, an identity fraud scheme that the department says siphoned more than $400 million in crypto over 18 months. The playbook: impostors stage bogus video meetings using hijacked accounts and AI-generated deepfakes of people the victim knows, claim a technical glitch needs fixing, plant malware, then take over communications to empty wallets and later go after the victim's contacts - which can occur months later or even after more than a year has passed since the breach.

People working in cryptocurrency and web3 are key targets. Assistant Director in Charge Patrick Grandy, of the FBI's Los Angeles Field Office, called FaceStealer "a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user." He added, "It exploits our trust in ubiquitous video conference platforms and valued personal relationships. If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."

Smart investors adapt to new tools to protect and grow their portfolios. We're hosting our first ever investor livestream on 11/17 to show you how to use ChatGPT and Claude to invest like a pro, hosted by Briefs Finance CEO Jaspreet Singh. Save your seat.

Why it matters for investors

The department framed these moves as part of a broader push to seize and return funds tied to North Korea. "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," Principal Deputy Assistant Attorney General for National Security M. Scott Proctor said. "America will fight back against that corrupt regime's effort to profit through cybercrime. The National Security Division will use every tool at its disposal to seize and return North Korea's ill-gotten gains."

For your portfolio, the recovery process bears watching as authorities continue freezing funds and pursuing laundering trails linked to "TraderTraitor." The report also featured two videos: "Binance co-CEO on crypto heist: We're getting an independent expert to review everything we've done" and "Binance's $6.3 billion breach will spark a long-term cyber arms race: Solana."

Understanding emerging tools can give investors a meaningful advantage in decision making. On 11/17, our CEO Jaspreet Singh goes live for our first ever investor livestream on how to use ChatGPT and Claude to invest like a pro. Register to join him.