The United States has moved to freeze over $2.7 billion in funds linked to a cryptocurrency theft from Binance, which the FBI attributes to a North Korean hacking group. The massive security breach, involving about $6 billion in stolen assets, was traced back to a theft that occurred around October 29, 2026, and now faces legal actions that allow authorities to seize at least $1.2 billion of the frozen funds. The Department of Justice (DOJ) announced the freeze on November 12 while also taking action against a separate North Korean scam dubbed “FaceStealer.”
TraderTraitor, ETH, and Crypto Smuggling Tactics
The FBI has identified the hacking collective known as TraderTraitor as being behind the Binance theft. According to investigators, the stolen crypto is being converted primarily into Ethereum before being funneled through decentralized finance (DeFi) tools, instant swapping services, mixers, and cross-chain bridges. These methods are designed to obscure the origin and trajectory of the funds, making tracking difficult. The FBI has requested various crypto service providers to block any transfers connected to addresses linked to the hackers.
Investigators believe the vulnerability may have stemmed from a compromised laptop belonging to a Binance engineer. Binance reportedly used its emergency SAFU fund to cover the losses suffered by customers. While the full scope of the breach is still under review, this incident joins a growing pattern of high-value hacks against major exchanges.
FaceStealer Campaign Unmasked
Alongside the Binance-related freeze, U.S. authorities unveiled more details about FaceStealer, a separate North Korean-led fraud campaign. Over 18 months, this scheme has victimized people for more than $400 million. The groups behind FaceStealer include Sapphire Sleet, UNC1069, BlueNoroff, APT38, and Stardust Chollima.
The scam typically starts with a hijacked social media or messaging app account. Attackers impersonate known associates to set up what appears to be a legitimate video call invite. They then redirect victims to fake Zoom or Teams platforms—and, in many cases, use actual recordings of acquaintances to add credibility. The malware involved steals credentials, records keyboard inputs, captures screen content, and secretly logs webcam footage. In some instances, attackers leverage unedited videos of real people; in others, they employ AI-based deepfakes. These tools are later used either during fake calls or to amplify trust in the deception.
Recommendations issued by the FBI include only joining meeting platforms like Zoom or Teams through authenticated invite codes, avoiding clicking links to join calls, and keeping webcams off until one has verified the host. Multi-factor authentication should be enabled across all platforms like Telegram and Slack, seed phrases should never be stored on devices, and users are urged to report incidents to government agencies when targeted.
These twin revelations—the freezing of Binance-related funds and the exposure of FaceStealer—demonstrate both the scale and sophistication of modern crypto-enabled cybercrime. U.S. authorities say collaboration between federal agencies and cryptocurrency platforms was key to tracking and freezing stolen assets.
The DOJ emphasized that the FaceStealer scam is distinct from the Binance theft, though both involve North Korean-linked groups and advanced money-laundering methods. The move to immobilize billions in crypto represents one of the largest enforcement actions to date in the fight against illicit blockchain activity.
Strategic cooperation between federal agencies—including the FBI, Secret Service, and IRS Criminal Investigation—and crypto service providers underpins the freeze. The DOJ’s National Security Division, its Criminal Division, and the U.S. Attorney’s Office for D.C. played central roles.
What this reveals is that even when attackers use complex techniques—bridges, mixers, real and AI-based fake identities—swift detection and cooperative legal mechanisms can still succeed. The Binance freeze shows that when authorities can work fast, significant amounts of criminal proceeds can be halted. On the flip side, FaceStealer underscores that human trust remains the cornerstone of many attacks: fake video calls. Going forward, tighter controls, platform verification, and awareness seem likely to be top priorities if the crypto industry is to meaningfully-shift the balance in this ongoing cyber war.
