US DOJ Seizes Cloud Infrastructure Used in North Korea-Linked 'FaceStealer' Attacks Involving Over $400 Million in Cryptocurrency Theft

November 13 - According to a U.S. Department of Justice announcement, U.S. law enforcement authorities on local time November 12 announced two operations targeting North Korea-related cryptocurrency theft activities: the seizure of cloud infrastructure used in the "FaceStealer" attack campaign; and in another Binance theft case, the U.S. government and private institutions have collectively frozen over $2.7 billion in involved assets, of which more than $1.2 billion has been authorized by courts for seizure or restricted transfer.

FaceStealer: Caused over $400 million in losses over the past 18 months. The FBI stated that the group used video conferencing and deepfake imagery to impersonate trusted contacts or well-known figures in the crypto industry of the targets, inducing victims to install malware. In addition to cryptocurrency holders and Web3 practitioners, the attackers are increasingly targeting open-source software developers and maintainers, attempting to gain access to their devices and code repositories. Based on federal search warrants, the FBI seized over 900 video recordings from victims' cameras and issued prevention and response guidelines.

Binance theft case: Over $1.2 billion is part of the frozen assets. The U.S. Department of Justice stated that around October 29, the North Korean military-related hacker group known as "TraderTraitor" by the FBI stole over $6 billion in crypto assets from Binance. After the incident, U.S. law enforcement agencies including the Department of Justice and the FBI, in cooperation with virtual asset service providers, froze some of the assets. The Department of Justice stated that tracing, freezing, seizure, and forfeiture procedures are still ongoing, and the frozen amount does not equal the amount returned.