Two weeks after the heist, the counterattack. The American Department of Justice announced Thursday, November 12, two coordinated operations against hackers in Pyongyang.
The first directly targets the October 29 Binance hack: a federal court authorizes the seizure of more than $1.2 billion in stolen funds. The second dismantles the cloud infrastructure of FaceStealer, a fake video call scam campaign that brought in more than $400 million in eighteen months for North Korea. In both cases, the FBI points to the same constellation of hackers.
The money hasn't been returned yet, but it won't move. The DOJ press release speaks of “seizure and freezing” of more than $1.2 billion in assets stolen from Binance “around October 29.” This sum is part of the 2.7 billion already frozen by the American authorities and the private sector, the two largest issuers of stablecoins in the lead. Out of a loot estimated at 6.3 billion, there remain around 3.6 billion in nature.
The FBI attributes the attack to TraderTraitor, the unit linked to the North Korean military already behind the Bybit hack in February 2025. Investigators say they continue to track funds across bridges, mixers and exchanges, and are asking platforms to block any transactions from the laundering addresses listed in a joint alert with the Secret Service and the IRS. “The North Korean government finances its rogue regime and its illicit weapons program through the theft of cryptocurrencies,” summarizes Mr. Scott Proctor, number two in the ministry’s national security division.
For Binance, the timing is good. The exchange announced the day before that it had finished covering all of its clients' assets and published new proof of reserves, two days after cutting ties with MEXC under pressure from the US Treasury.
The second concerns a much more artisanal trap, and one that is extremely effective. You receive an invitation to a video call from a partner or investor you know. The interface resembles Zoom or Microsoft Teams. Your interlocutor appears on the screen, their face, their voice. Then a “technical problem” occurs, and you are asked to install a patch or issue a command. This patch is malware. It empties your wallets and opens the door to your other systems.
The face is fake. According to the FBI alert, hackers are replaying webcam clips recorded without the knowledge of previous victims, and increasingly videos generated by AI. Each victim enriches the attackers’ address book and image bank, which the Bureau describes as an “exponential” growth in the target pool. Agents seized more than 900 of these videos and the cloud infrastructure that was used to distribute them.
The figures are dizzying. More than $400 million stolen in eighteen months, according to Brett Leatherman, director of operations for the FBI's cyber branch. The campaign, attached to the APT38 group (also known as BlueNoroff or Sapphire Sleet), is not only aimed at crypto holders. It also targets developers who maintain widely used open source software, with the idea of compromising the entire software supply chain at once.
The message sent to exchanges is twofold. On the one hand, the DOJ asks them to block the addresses listed by the FBI, a de facto obligation for any platform that wants to keep its American banking relationships. On the other hand, FaceStealer reminds us that the flaw, in the Binance case as elsewhere, remains human: the attack of October 29 started from the compromised computer of an engineer. A convincing video call is enough.
The FBI has put a dedicated page online, fbi.gov/facestealer, and recommends a simple rule to crypto teams: never install software or execute a command at the request of a videoconference interlocutor, even a known one, without verification by another channel. The 900 videos seized will also be used to warn people whose images have been used.
