SECURITY ALERT

Two weeks after the theft, some of the money has stopped moving.

Some of it now has a court order attached.

US prosecutors have won a court’s authorisation to seize or restrain over $1.2 billion of the crypto stolen from Binance, the Justice Department said on Thursday.

That sum is part of more than $2.7 billion frozen so far by the US government and private companies working together, the department said.

The theft took more than $6 billion from Binance on or about 29 October. The FBI attributes it to members of the North Korean military that it calls TraderTraitor.

Frozen is not seized. Seized is not returned.

The release does not say who would receive any money that is eventually forfeited.

Where the $1.2 billion fits

Binance said its coverage of the losses was complete on Thursday, after it put more than $6.34 billion of its own money into replacing the stolen tokens.

The DOJ figures describe the other side of the ledger: the stolen assets themselves.

The work was led by the National Security Division’s cyber section, the Criminal Division’s Computer Crime and Intellectual Property Section and the US Attorney’s Office for the District of Columbia.

They worked with crypto service providers to stop the funds, the department said. Assistant Attorney General A. Tysen Duva said the Criminal Division helped “immediately halt about half of this historic breach.”

The tracing is not finished. TraderTraitor actors are still laundering the rest through bridges, mixers and exchanges, according to the release.

the FBI’s alert naming TraderTraitor asked exchanges to block addresses tied to that laundering. Binance has said the attack began with a fake job interview.

More than half of the stolen value is not in the frozen total. Where is it now?

FaceStealer: the meeting that installs malware

The second action is smaller in dollars and closer to home for anyone who works in crypto.

The US Attorney’s Office for the Central District of California announced that the FBI had taken down cloud infrastructure used in a scheme it calls FaceStealer. The scheme has stolen more than $400 million in the past 18 months, the department said.

The FBI attributes it to North Korean hackers that security firms track as Sapphire Sleet, UNC1069, BlueNoroff, APT38 and Stardust Chollima, among other names.

Here is how it works, according to the FBI’s FLASH alert.

A message arrives from someone you know, on Telegram, LinkedIn, Slack or Discord. The account is real. It was hijacked from an earlier victim.

The link opens a convincing copy of Zoom, Teams or Google Meet on a look-alike domain.

On screen are faces you recognise. They are recordings of earlier victims, captured from their webcams while they waited for their own calls to start.

Then someone says you cannot be heard. They send a fix: an “update” prompt, a script, or a line of code to paste into a terminal.

The fix is the malware. The FBI says it installs a browser cookie harvester, keyloggers, screen capturers and a backdoor, and the hackers have recorded your webcam from the moment you clicked the link.

You are now the face in the next meeting.

The FBI says it seized more than 900 such webcam videos under a federal warrant.

In several cases, the theft came anywhere from several months to over a year after the first infection, once wallet balances had grown. The FBI says the group has also begun to add deepfake videos of well-known crypto figures to the calls.

We have seen the pattern before, when a fake Teams invite led to a breach at SignalPlus this month.

Why developers are a target

The FBI says the same technique is now aimed at people who maintain open-source software.

Earlier this year, it says, a maintainer of a JavaScript library with tens of millions of weekly downloads joined a fake Teams call, ran the “fix” and had his machine infected. The hackers then used his access to push malicious dependencies before the compromise was caught.

The FBI says it knows of other attempts against maintainers on npm and, recently, Rust crates.

One infected maintainer can reach every machine that installs the library. Who checks the call before the code ships?

The record so far

  • 29 Oct (on or about). More than $6 billion is stolen from Binance, the DOJ says.
  • After the theft. The FBI attributes it to TraderTraitor and asks exchanges to block laundering addresses.
  • 12 Nov. Binance says its coverage of affected assets is complete.
  • 12 Nov. The DOJ announces more than $2.7 billion frozen, a court order covering over $1.2 billion of it, and the FaceStealer takedown. The FBI publishes its alert and a resource page at fbi.gov/facestealer.

Protect yourself (from the FBI’s recommendations)

  • Join calls from the official Zoom or Teams app with an invite code, not from a link, especially when the contact is new or rarely in touch.
  • Keep your camera off until you can see and hear the person who invited you.
  • Never run a script or paste code into a terminal to “fix” a call. Update the app separately.
  • Confirm meetings through a second channel: if the invite came by Telegram, check by phone or text.
  • Turn on multifactor authentication and login alerts for Telegram, WhatsApp and Slack.
  • Keep only small sums in browser-extension wallets. Never store a recovery phrase or private key on your computer; the FBI says the hackers copy phrases and wait for balances to grow. Here is what a recovery phrase protects.
  • If you think you were hit, move funds to a new wallet with a new phrase on a clean device, warn your contacts and employer, change passwords and report it at ic3.gov with the keyword “FaceStealer”.

$1.2 billion has a court order. $400 million went through a video call.

If the person on your screen is a recording, what else in the meeting is real?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.