DOJ moves to seize $1.2B stolen in Binance hack and takes down North Korea's deepfake FaceStealer scheme
A court authorised seizing or restraining over $1.2 billion of last month's $6.3 billion Binance theft and taking down infrastructure behind FaceStealer, which the FBI says used fake video calls and deepfakes to steal more than $400 million in 18 months.
Why it matters
The order covers roughly half of the $2.7 billion that crypto platforms froze after the Binance theft, which Binance and the FBI attribute to North Korea's TraderTraitor group. FaceStealer, tied to the Sapphire Sleet group, lured crypto workers and open-source maintainers into fake Zoom or Teams calls that played recorded or deepfake video of a familiar contact, then pushed malware as an audio fix. The FBI seized more than 900 webcam videos. Watch whether the restrained funds are forfeited and how much more is traced.
Key facts
- Court authorised seizing or restraining over $1.2 billion
- Binance theft last month: $6.3 billion
- Platforms froze $2.7 billion in total
- FaceStealer took more than $400 million in 18 months
- FBI seized more than 900 webcam videos
- FBI attributes FaceStealer to Sapphire Sleet