LAGOS NOVEMBER 14TH (NEWSRANGERS)-The US Department of Justice (DoJ) has said it was granted court authorization to “seize or restrain” $1.2 billion recently stolen from Binance.
In late October 2026, Binance reported losing $6.7 billion in a highly sophisticated heist that played out over roughly 20 minutes. In the days that followed, we learned that the heist was carried out by TraderTraitor, a subset of the infamous Lazarus Group, notorious North Korean state-sponsored threat actors responsible for some of the biggest crypto robberies to ever happen.
The community rallied around Binance, helping trace the funds and label the attackers’ wallets. Now, US law enforcement says at least part of those funds was seized or frozen. The agency did not say what that meant, how it was done, or if Binance will ever see those tokens again.
Almost $3bn seized
“Since the theft, the National Security Division’s National Security Cyber Section, the Criminal Division’s Computer Crime and Intellectual Property Section, the U.S. Attorney’s Office for the District of Columbia, and law enforcement partners have worked closely with virtual asset service providers (VASPs) to interdict the stolen assets,” the DoJ said in the announcement.
“Collective U.S. government and private sector efforts so far have resulted in the freeze of more than $2.7 billion, with the Department having already obtained court-authorization to seize or restrain in excess of $1.2 billion of that amount.”
In the same report, the DOJ also said the US government disrupted cloud-based infrastructure that North Korean hackers used in a social engineering scheme called FaceStealer. This scheme was allegedly not used in the Binance hack, but it did result in the theft of around $400 million over the last 18 months, cumulatively. Furthermore, the methodology is almost identical to what TraderTraitor used in its attack.
FaceStealer
We also learned that the preparation for the attack took months, and that the group broke into Binance through an employee’s device. That employee was allegedly invited to a fake job interview, through which they were served malware that ultimately granted TraderTraitor valuable access. How they escalated that access into the biggest crypto heist ever remains to be seen.
The group pulled the money from 10 different chains, including Bitcoin, Ethereum, XRP, Solana, Arbitrum, and others. Once the money – which belonged to Binance and not its customers – left the company’s wallets, it was sent to different “mixers” and other laundering services.
FaceStealer is a scheme that does exactly what the name suggests – steals people’s faces, so that they can be used in identity theft which is a vital cog in the larger crypto theft engine.
According to the DoJ, criminals would first compromise an account belonging to their target’s contact, and try to get them on a video call. That call would be done on a fake Zoom platform – their victim would see their contact’s video feed which, in reality, was just a previously stolen recording. They would hear no audio, and would then receive a message that they need to update their computer’s driver to be able to hear audio and participate in the call. The driver, in this scenario, is the malware, usually either an infostealer or a steppingstone into a wider network.
Techradar
For advertisement placement, events coverage, media consultancy, placement of publications and further enquiries please WhatsApp 2348023773039 or email: labakevwe@yahoo.com
