Details on US Freezing $2.7 Billion After North Korean Binance Hack | Today’s news

The Justice Department says it has teamed up with two of the biggest stablecoin issuers in an effort to recover nearly half of the money stolen when hackers made off with more than $6 billion from crypto exchange Binance.

The department won court permission to seize or limit $1.2 billion of the $2.7 billion in funds frozen by Tether and Circle Internet Group Inc. immediately after the Oct. 29 burglary. Investigators continue to pursue the rest as the hackers, dubbed TraderTraitor by the FBI, try to launder the cryptocurrency through bridges, mixers and exchanges.

“The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains,” M. Scott Proctor, principal deputy assistant attorney general for national security, said in a statement. He said North Korea uses cryptocurrency theft to fund its government and weapons program.

The attack on the world’s largest cryptocurrency exchange was the largest cryptocurrency theft on record, draining $6.3 billion in digital assets from customers. Binance has since replaced all stolen assets using profits and emergency funds.

The exchange said the hackers first compromised an engineer through a fake job interview before infiltrating other employees working on its digital wallets, part of what Binance described as a months-long operation involving malicious software, compromised devices and artificial intelligence.

The hackers then began moving the stolen assets through thousands of digital wallets and multiple blockchains to hide their origin. Within a week, the laundering operation used more than 20,000 wallets and made at least 65,000 transactions, according to blockchain analytics firm Elliptic, while stablecoin issuers and other companies froze billions of dollars before they could be transferred.

Assistant Attorney General A. Tysen Duva said the criminal division and law enforcement partners froze Binance’s assets “before they were beyond the reach of law enforcement,” stopping roughly half of what he called a “historic breach.”

The FBI, Secret Service and Internal Revenue Service issued an alert shortly after, attributing the theft to North Korea and urging digital asset companies to block transactions involving addresses used by the hackers. North Korea has denied responsibility for cryptocurrency thefts attributed to it.

The Justice Department also said Thursday it had seized the cloud infrastructure supporting a separate North Korean hacking operation that stole more than $400 million in cryptocurrencies over the past 18 months. The FBI calls this scheme FaceStealer.

FaceStealer uses the victims themselves to make the next attack more convincing. Hackers hijack messaging and social media accounts and use them to invite the victim’s contacts to fake Zoom or Microsoft Teams meetings. Once the target connects, they play pre-recorded webcam footage of someone the target knows, create an apparent technical problem, and offer a “fix” that installs the malware instead.

“If you can’t imagine a scenario where you could be a victim, you’re not thinking creatively enough,” Patrick Grandy, deputy director in charge of the FBI’s Los Angeles field office, said in a statement.

The FBI seized more than 900 webcam videos secretly recorded from victims and later impersonated. Hackers have also started using deepfakes of prominent figures in the cryptocurrency industry to make fraudulent encounters more convincing.

The campaign is increasingly targeting open-source software developers, raising the prospect that a single person’s compromise could expose a much larger number of users. Earlier this year, hackers infected the computer of the administrator of a JavaScript library downloaded tens of millions of times a week and attempted to create malicious dependencies that would be distributed with legitimate downloads. According to the FBI, the effort was detected before the malware could spread.

This article was generated from an automated news agency source without text modification.