# DOJ Seizes $1.2B in Binance Heist Funds Linked to North Korea FBI disrupts North Korean 'FaceStealer' social engineering scheme targeting crypto and tech workers. - **Source:** [www.theregister.com - Articles](https://brifing.si/source/2c34ea50-d341-4a10-925d-12c012a9ad10) - **Published:** 2026-11-12 - **Topic:** [world](https://brifing.si/c/world) - **Original article:** - **On Brifing:** https://brifing.si/s/a573b49b-989a-4bef-8252-9a8a0c17fe6c ## DOJ Seizes $1.2 Billion The US Department of Justice secured court authorization to seize or restrain $1.2 billion in assets linked to a massive $6.3 billion Binance heist. This action is part of a broader federal strategy to disrupt North Korean cryptocurrency theft operations that target global financial systems and digital infrastructure. ## FaceStealer Social Engineering Scheme The court also authorized the takedown of infrastructure used in the FaceStealer campaign, which has amassed over $400 million in 18 months. This operation utilizes secretly recorded webcam videos to deceive victims, primarily targeting professionals within the cryptocurrency, web3 industries, and various open source software developers and maintainers. ## FBI Seizes Webcam Footage The FBI successfully seized more than 900 webcam videos stolen from tech workers during these social engineering attacks. By hijacking credible accounts, attackers send calendar invites containing typo-squatted URLs. These links lead victims to fake video meetings, allowing hackers to record faces and facilitate further malicious impersonation attempts. ## Deceptive Video Call Tactics During fake Zoom or Teams meetings, hackers play prerecorded videos of trusted associates while disabling audio to maintain the ruse. Victims are instructed via text boxes to download software updates to fix audio issues. These malicious files install cryptocurrency-stealing malware and harvest contact lists to expand the scam. ## Sapphire Sleet Attribution The FBI attributes the FaceStealer activity to a North Korea-linked group known as Sapphire Sleet, which is considered an offshoot of the Lazarus Group. This entity operates under multiple aliases, including UNC1069, Stardust Chollima, APT38, and BlueNoroff, focusing on generating revenue for the regime through sophisticated cyber intrusions. ## Binance Heist Groundwork The $6.3 billion Binance theft, attributed to the TraderTraitor hacking operation, involved extensive preparation starting in June. Attackers utilized fake job interviews, compromised internal AI tools, and endpoint takeovers. This multi-stage campaign culminated in an advanced transaction-authorization method that allowed the perpetrators to bypass standard security protocols effectively. ## Asset Recovery Efforts Following the October 29 attack, federal investigators and private-sector partners have successfully frozen more than $2.7 billion in stolen assets. The current $1.2 billion DOJ authorization represents a significant portion of these recovered funds, highlighting the ongoing cooperation between law enforcement and private entities to mitigate financial losses. ## Evolution of Cyber Threats North Korean hackers are increasingly integrating deepfake technology and social engineering to enhance the scalability of their impersonation efforts. By targeting software repositories, these actors aim to launch supply chain attacks. This shift necessitates heightened vigilance among developers and organizations regarding the authenticity of digital communication and meeting invitations. ## Sources covering this story - https://www.theregister.com/cyber-crime/2026/11/12/doj-takes-aim-at-12b-in-binance-loot-as-fbi-disrupts-north-korean-scam/5309523 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._