U.S. Justice Department steps up cryptocurrency seizure actions against North Korea cyber schemes

Traders Union
All News
Crypto
US DOJ boosts crypto seizures

Highlights

U.S. Justice Department seized over $1.2 billion in cryptocurrency linked to funds recently stolen from Binance and disrupted FaceStealer cloud infrastructure.
FaceStealer campaign stole more than $400 million in cryptocurrency in 18 months using AI deepfakes and malware, raising supply-chain attack risks.
North Korean group TraderTraitor stole over $6 billion in virtual assets from Binance, with more than $2.7 billion frozen and laundering attempts ongoing.

Enforcement action targets FaceStealer and stolen Binance assets

As reported by Justice Department, citing the U.S. Department of Justice, the coordinated action includes the seizure of cloud infrastructure used in the FaceStealer campaign and the restraint or seizure of more than $1.2 billion in cryptocurrency linked to funds recently stolen from Binance.

The department says FaceStealer has resulted in the theft of more than $400 million in cryptocurrency over the past 18 months. Officials say the scheme uses stolen accounts, prerecorded webcam footage and AI-generated deepfakes to persuade targets in video meetings to install malware disguised as a fix for supposed technical problems.

According to the Justice Department, North Korean cyber actors are using the operation not only to steal digital assets but also to pursue access to people involved in maintaining open-source software. The FBI says that raises the risk of broader supply-chain attacks, and it has seized more than 900 webcam videos of FaceStealer victims under a federal warrant.

In a separate case, the department says members of the North Korean military group the FBI refers to as TraderTraitor stole more than $6 billion in virtual assets from Binance on or about Oct. 29. U.S. government agencies and private-sector partners have since frozen more than $2.7 billion, while court authorization has already been obtained to seize or restrain more than $1.2 billion of that amount.

Cybersecurity and digital asset industry face wider risk

The action underscores how cryptocurrency platforms and Web3 businesses remain exposed to state-backed cybercrime, especially when attacks combine social engineering with increasingly sophisticated AI tools. U.S. officials say the North Korean regime relies on proceeds from large-scale cryptocurrency theft to support illicit weapons activity, making asset recovery and disruption a national security priority.

Authorities also say the threat now extends beyond direct theft from individual holders and exchanges. By targeting developers and maintainers in the open-source ecosystem, attackers are seeking access that could compromise software repositories and create downstream risks for companies that depend on shared code.

Efforts to trace, freeze, seize and forfeit the stolen assets are continuing, with officials saying TraderTraitor actors are still trying to launder funds through cryptocurrency bridges, mixers and exchanges. The FBI has also published guidance on how the FaceStealer scheme works and what potential victims can do if they suspect a compromise.

Previously, we highlighted Nasdaq 100 volatility driven by AI supply-chain concerns and higher financing costs in tech stocks.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.