DOJ Targets North Korean Cryptocurrency Theft

The Justice Department announced Nov. 12 that it had obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance and disrupted a separate North Korean hacking operation targeting cryptocurrency holders and software developers.

U.S. authorities and private-sector partners have frozen more than $2.7 billion from the Binance theft, including the assets covered by the court orders. Recovery efforts continue as hackers move funds through cryptocurrency bridges, mixers and exchanges.

The FBI attributed the theft of more than $6 billion on or about Oct. 29 to North Korean actors it calls “TraderTraitor.” It urged digital-asset service providers to block transactions involving identified laundering addresses or funds derived from them.

Separately, authorities seized cloud infrastructure supporting “FaceStealer,” a scheme DOJ linked to more than $400 million in thefts over 18 months. Attackers impersonate trusted contacts in video meetings, using recorded footage and deepfakes, then induce victims to install malware disguised as a technical fix.

The campaign increasingly targets open-source software maintainers, potentially enabling broader supply-chain attacks. The FBI seized more than 900 victim webcam recordings. DOJ said North Korea uses cryptocurrency theft to finance its government and illicit weapons program.