Security News US freezes billions stolen by North Korean hackers in Binance heist

[Brownie2019]

Content source

https://www.bitdefender.com/en-us/blog/hotforsecurity/us-seizes-1-billion-north-korea-binance-crypto

US authorities have frozen billions in cryptocurrency stolen by North Korean hackers, while dismantling a separate operation that used deepfake video calls to steal hundreds of millions more.

The US Justice Department has announced a major crackdown on North Korea's cryptocurrency theft operations, securing court authorization to seize or restrain more than $1.2 billion in digital assets stolen from Binance in October.

The Nov. 12 announcement also reveals the disruption of a separate North Korean hacking campaign that used fake video meetings, stolen accounts and AI-generated deepfakes to steal more than $400 million in cryptocurrency.
The Justice Department said US authorities and private-sector partners have collectively frozen more than $2.7 billion of the funds stolen in the Binance attack, described as the largest cryptocurrency heist on record.

Key points
US authorities have secured court orders to seize or restrain more than $1.2 billion stolen from Binance
Government agencies and private companies have frozen over $2.7 billion of the stolen cryptocurrency
The FBI also disrupted FaceStealer, a North Korean operation linked to more than $400 million in cryptocurrency theft
Hackers used deepfake video calls, compromised accounts and fake technical problems to trick victims into installing malware

Billions frozen after record-breaking Binance heist

Read full Story:

US Moves to Seize $1.2B Stolen in North Korean Binance Hack

US authorities move to seize $1.2 billion stolen in North Korea's Binance hack and dismantle a deepfake scam linked to $400 million in crypto theft.

www.bitdefender.com

 

[Bot]

Read full Story: (link omitted)

Hi Brownie. This is a substantial disruption, although “frozen” is not the same as “recovered.” The DOJ announcement says TraderTraitor stole more than $6 billion from Binance on or about Oct. 29. Government and private-sector partners have frozen over $2.7 billion, while the DOJ has court authorization to seize or restrain more than $1.2 billion. That does not mean all $2.7 billion is already in government custody or has been returned to Binance.

FaceStealer is a separate campaign, and arguably the more useful warning for ordinary users and developers. The attackers reportedly:

• Sent meeting invitations from accounts belonging to previous victims.
• Replayed recorded webcam footage or used deepfakes to impersonate trusted people.
• Invented an audio or technical problem during the meeting.
• Supplied a supposed “fix” that actually installed malware.

The DOJ says exploitation sometimes occurred months or even more than a year later, so an uneventful meeting and a clean quick scan would not necessarily settle the matter.

Practical defenses are refreshingly unglamorous:

• Never install a codec, extension, script or “meeting fix” supplied during a call. Update through the application or vendor’s official site.
• Verify unexpected software or wallet requests through a separate, known contact method.
• Use hardware-backed authentication, separate signing/build systems and multi-person approval for valuable cryptocurrency transfers.
• If such a fix was actually executed, disconnect the affected device and treat it as compromised: revoke sessions and rotate credentials from a trusted device, then investigate properly.

Deepfakes make the performance more convincing, but the decisive step remains persuading the victim to execute something. AI provides the costume; the malware still needs a door.

Sources

• Office of Public Affairs | Justice Department Announces Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency | United States Department of Justice