North Korean Hackers: Washington Seizes $1.2 Billion in Stolen Crypto

The US Department of Justice has obtained a judicial order to seize or freeze more than $1.2 billion in cryptocurrencies stolen from the "Binance" platform by a group of North Korean hackers, at a time when the US Federal Bureau of Investigation announced the dismantling of an online fraud network that used fake video calls to steal digital assets worth over $400 million.

North Korean Hackers Case
According to the French specialized cryptocurrency website "Coin Academy," the US Department of Justice obtained on Thursday, November 12, a judicial order to seize or freeze funds linked to the hacking operation targeting the "Binance" platform in late October by North Korean hackers.

This operation is considered the first major judicial outcome since the hack described as record-breaking, as the ministry announced that the targeted funds constitute part of more than $2.7 billion frozen thanks to cooperation between US authorities and private companies.
Money tracking operations are still ongoing after the hackers resorted to transferring digital assets via blockchain bridges, which are tools that allow currency conversion between different networks, as well as using cryptocurrency mixing services that hide the source of funds, and digital asset trading platforms.

The US Department of Justice attributed the attack to the "Trader Traitor" group, stating it is linked to the North Korean army, and accused them of stealing more than $6 billion from the "Binance" platform around October 29.

The amount for which US authorities obtained a seizure order represents about 20% of the total stolen funds, according to the site's estimates.

Washington considers these operations a direct source of funding for North Korea, as Scott Proctor, First Assistant Attorney General for National Security, said, "The North Korean regime finances its illicit armament program through cryptocurrency theft."

"Binance" Compensates Affected Users
In response, the "Binance" platform announced that it had completed covering the assets affected by the breach.

The platform had estimated its losses at approximately $6.3 billion and allocated $6.34 billion of its own funds to cover these losses.

Hours before the US Department of Justice announcement, the platform stated that it had completed compensating for the damaged assets and published a proof-of-reserves update, a mechanism that allows public verification of assets covering customer deposits.

Thus, affected users no longer need to wait for fund recovery through judicial proceedings to retrieve their assets, while the US Department of Justice stated that it seeks to seize the funds acquired by North Korea and return them.

Fraud Network Using Fake Video Calls
In parallel, the US Department of Justice announced the seizure of cloud infrastructure for a North Korean hacking campaign dubbed "Face Stealer" by the FBI.

According to the ministry, this campaign managed to steal more than $400 million in cryptocurrencies during the past 18 months.

Afterward, the hackers deceive victims into believing there is a technical problem and push them to install malicious software that allows them to take over cryptocurrency wallets or access other systems.

Malicious software may remain dormant for long periods, as the Department of Justice noted that control over contact accounts can sometimes occur months, or even more than a year, after the initial infection.

The hackers then use the contacts they have obtained to target new victims, including open-source software developers, with the aim of launching potential attacks through the code they develop.