US seizes $1.2 billion from Binance theft, disrupts FaceStealer
Original title: Feds announce seizure of $1.2 billion from Binance theft; also takedown of ‘FaceStealer’ tools
Platforms froze $2.7 billion of a $6.3 billion Binance theft that Binance and the FBI attribute to TraderTraitor.
The Justice Department said it obtained court authorization to seize or restrain more than $1.2 billion stolen from Binance, part of $2.7 billion frozen after a $6.3 billion theft. Binance and the FBI attribute the theft to North Korea's TraderTraitor, and tracing is ongoing. Separately, the FBI and DOJ disrupted cloud infrastructure used in FaceStealer, a video-meeting social-engineering scheme they say stole more than $400 million in 18 months, and seized more than 900 victim webcam videos.
Unconfirmed: The FBI has not confirmed FaceStealer was used in the Binance breach, and laundering methods are described by blockchain firms.
- DOJ says it halted about half of the stolen Binance assets before they moved further.
- FaceStealer lures use stolen accounts, Calendly invites, and fake Zoom or Teams domains.
- The supposed meeting fix installs a cookie harvester, keyloggers, screen capture, and a backdoor.
- An FBI agent said it is unclear whether FaceStealer was used against Binance.
- Targets include crypto users and open-source developers, including NPM maintainers.
Impact: Cryptocurrency theft plus malware and hijacked accounts
- 1.Treat unexpected Zoom or Teams fix links from meeting invites as malicious.
- ATT&CK
- T1566.002 Spearphishing LinkT1539 Steal Web Session CookieT1056.001 Input CaptureT1113 Screen Capture
- Vendors
- Binance
- Threat actors
- TraderTraitor
- Malware
- FaceStealer
- Victims
- Binance
- Organizations
- US Department of JusticeFBI
- Countries
- North KoreaUnited States
From the original article
5 min read at therecord.mediaThe Department of Justice and FBI announced two separate actions in response to North Korea-linked cryptocurrency theft operations.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.