US Freezes $2.7 Billion Stolen by North Korean Hackers in Massive $6 Billion Binance Crypto Heist

The US government has frozen more than $2.7 billion of the crypto stolen from Binance on or about October 29, 2026. The FBI says North Korea took over $6 billion in that theft.

Court orders already allow US officials to seize or hold more than $1.2 billion of the frozen funds. The Justice Department announced the action on November 12, along with a separate move against a North Korean scam called FaceStealer.

The FBI blames a North Korean group it calls TraderTraitor for the Binance theft. As our earlier report on the FBI’s attribution of the Binance theft noted, the bureau tied the case to North Korea within days.

The FBI, Secret Service, and IRS Criminal Investigation say the thieves are mostly turning stolen funds into Ethereum. They then plan to push the money through DeFi tools and instant swap services to hide its path.

The Justice Department says its National Security Division, Criminal Division, and the US Attorney’s Office for the District of Columbia worked with crypto service providers to stop the money.

Officials say the thieves keep moving funds through bridges, mixers, and exchanges. The FBI has asked service providers to block any transfers linked to the addresses the hackers use.

Binance itself reported that customers were made whole. Reports say the exchange covered losses from its SAFU emergency fund, and early findings point to a compromised engineer’s laptop.

US Freezes $2.7B in North Korean Crypto Heist Funds

The Justice Department stressed that FaceStealer is a different campaign from the Binance theft. The FBI says it has cost victims more than $400 million in 18 months.

It blames groups tracked as Sapphire Sleet, UNC1069, BlueNoroff, APT38, and Stardust Chollima. Agents seized cloud servers used in the scheme, along with over 900 secretly recorded victim webcam videos.

The trick starts with a hijacked account, often on Telegram. The hackers message the victim’s contacts and propose a video call. They then send a link to a fake Zoom or Teams site. Inside, the target sees a recorded video of someone they know, which makes the call look real.

The malware campaign uses fake meeting audio-fix prompts to trick victims into installing cookie stealers, keyloggers, screen-capture tools, and backdoors, while stolen webcam footage fuels further fake meetings.

Some attacks have used AI to make deepfake videos of well-known crypto figures. The FBI says the scheme still mostly relies on real stolen videos. Hackers have also waited months, or even more than a year, to drain wallets, watching balances grow.

The FBI warns that the same trick now targets open-source maintainers. Earlier this year, hackers lured the maintainer of a popular JavaScript library into a fake Teams call and infected his computer.

They then tried to add bad dependencies to a library with tens of millions of weekly downloads. Quick detection stopped it. This fits a wider pattern. Our coverage of UNC1069, which used fake Zoom and Teams meetings, showed the same fake error and copy-and-paste step.

The FBI’s advice is simple. Join calls through the official Zoom or Teams app with an invite code instead of clicking links. Keep your webcam off until you can see and hear the person who invited you.

Never paste commands into a terminal to fix a meeting problem. Confirm invites through a second channel, and turn on multifactor authentication for Telegram, Slack, and similar apps.

Keep only small amounts in browser wallets, and never store seed phrases on your devices. If you think you were hit, move funds to a new wallet on a clean device, change passwords, log out all sessions, warn your contacts, and report it at IC3.gov with the keyword “FaceStealer.”

The freeze shows that fast action can save stolen funds. The FaceStealer case shows that one convincing video call can still start the next big theft.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post US Freezes $2.7 Billion Stolen by North Korean Hackers in Massive $6 Billion Binance Crypto Heist appeared first on Cyber Security News.