US Department of Justice seizes cloud infrastructure used in North Korea-linked 'FaceStealer' attack, tied to over $400 million in stolen cryptocurrency.

According to a U.S. Department of Justice (DOJ) announcement, U.S. law enforcement agencies on local time November 12 unveiled two actions targeting North Korea-linked cryptocurrency theft operations: seizing cloud infrastructure used in the "FaceStealer" attack campaign, and in a separate Binance theft case, U.S. government and private partners have collectively frozen over $2.7 billion in involved assets, with more than $1.2 billion authorized by courts for seizure or transfer restrictions. FaceStealer has caused over $400 million in losses over the past 18 months. The FBI said the group uses video conferencing and deepfake videos to impersonate contacts trusted by targets or prominent crypto industry figures, luring victims to install malware. Beyond crypto holders and Web3 workers, attackers are increasingly targeting open-source software developers and maintainers to gain access to their devices and code repositories. Acting on federal search warrants, the FBI seized more than 900 victim camera recordings and issued prevention and response guidelines. On the Binance theft case: The over $1.2 billion forms part of the frozen assets. The DOJ stated that around October 29, the North Korean military-linked hacker group dubbed "TraderTraitor" by the FBI stole over $6 billion in crypto assets from Binance. Following the incident, law enforcement agencies including the DOJ and FBI collaborated with virtual asset service providers to freeze a portion of the stolen funds. The DOJ added that tracking, freezing, seizure and forfeiture procedures are ongoing, and the frozen amount does not equal the total to be returned to victims.