North Korea Pulled Off the Biggest Crypto Heist Ever. America Just Seized $1.2 Billion of It.

Two weeks ago North Korea’s military hackers walked out of Binance with more than $6 billion in about the time it takes to eat lunch. It was the biggest crypto theft anyone has ever recorded, and the money was supposed to vanish into Pyongyang’s weapons budget.

On Thursday, the Justice Department announced it is taking a big piece of it back.

Federal prosecutors have won court authorization to seize or restrain more than $1.2 billion of the stolen Binance money, according to the Justice Department’s announcement. Counting what crypto companies locked down at the government’s request, more than $2.7 billion is now frozen.

We covered the heist itself on Oct. 30, when outside investigators first pinned it on North Korea. What’s new is that Washington has stopped describing the crime and started reversing it. The same announcement also took down a second North Korean racket most people have never heard of, one that could reach anyone who has ever joined a video call.

Half the loot, frozen in two weeks

The FBI calls the Binance thieves TraderTraitor, a unit of North Korea’s military that has been robbing crypto firms for years. Since the Oct. 29 theft, the Justice Department’s national security cyber team, its computer crime prosecutors and the U.S. Attorney’s Office in Washington have been chasing the money in real time,.

Speed was the whole game. Stolen crypto can be split, swapped and pushed through mixers within hours. Assistant Attorney General A. Tysen Duva, who runs the Criminal Division, said his team “played the critical role in immediately freezing billions of dollars’ worth of stolen Binance digital assets before they got beyond law enforcement reach,” and halted “about half of this historic breach.”

Jeanine Pirro, the U.S. Attorney for the District of Columbia, put it more bluntly. “By springing into action at a moment’s notice, we worked together to freeze this massive criminal fraud in its tracks,” she said. “The North Korean regime may think they are sophisticated cyber criminals, but we have consistently met them head on, as we did here seizing more than $1.2 billion of their stolen assets.”

The chase isn’t over. The department says TraderTraitor is still laundering what it kept through crypto bridges, mixers and exchanges. Last week the FBI, the Secret Service and IRS investigators put out an alert naming the wallet addresses the hackers are using and asking the industry to refuse anything that touches them.

The video call that wasn’t real

The second operation is the one regular people should read twice. The FBI calls it FaceStealer, and it has taken more than $400 million over the last 18 months. The bureau laid out how it works in a warning bulletin released Thursday.

It starts with someone you know. North Korean hackers take over a real person’s Telegram, LinkedIn, Slack or Discord account, read their old chats, and message their friends and coworkers with something ordinary: let’s catch up, let’s talk about a project. A calendar invite follows. Right before the meeting, a link arrives that looks like Zoom or Microsoft Teams but leads to a copycat site the hackers built to look identical.

You join, and there’s your friend on camera. Except it isn’t your friend. It’s a recording of them, captured secretly while they sat in a fake meeting lobby of their own. Then comes the trap. A message says nobody can hear you and points you to a quick fix: click an update, run a command, paste a line of code. That “fix” installs keyloggers, screen recorders, a cookie stealer and a back door. You’re the next victim, and your contacts are the next targets.

The bureau said the pool of victims “grows exponentially” this way. It also said the hackers have started using SI to make deepfake videos of well-known crypto figures from public photos and clips, though real stolen webcam footage still does most of the work. Under a federal warrant, agents seized the hackers’ cloud servers and more than 900 of those secretly recorded victim videos.

The FBI’s cyber branch put the warning out in plain language:

A near miss for the whole internet

Crypto traders were the main targets, but the scarier part of the bulletin is about software. North Korea has gone after the volunteers and developers who maintain free code libraries that millions of apps quietly depend on. Earlier this year, the FBI says, the hackers lured the maintainer of a major JavaScript library, one downloaded tens of millions of times a week, into a fake Teams call stocked with familiar faces. He ran the “fix,” and the hackers used his access to slip malicious add-ons into the library’s downloads.

It was caught quickly. If it hadn’t been, the bureau said, it “could easily have resulted in very large-scale victimization.”

Patrick Grandy, who runs the FBI’s Los Angeles office that led the case, didn’t sugarcoat it. “If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” he said.

How not to be the next face on the screen

The FBI’s advice is simple enough to use tomorrow. Join meetings through the real Zoom or Teams app with a meeting code instead of clicking a link, especially from someone you rarely hear from. Keep your camera off until you can actually see and talk with the person who invited you. Never paste code or run a script because a meeting window tells you to; update the app on your own. Confirm surprise meetings by text or a phone call.

Anyone holding crypto should keep big balances off the computer entirely and never store recovery phrases on a device. The bureau says these hackers have copied recovery phrases and then waited months, even more than a year, for a wallet to fill up before draining it. If you think you’ve been hit, move your coins to a brand-new wallet made on a clean device, change your passwords, log out every session and warn your contacts before someone wearing your face calls them.

None of this is petty theft. “North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, the top deputy in the department’s National Security Division. “Today’s announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime.”

About $1.2 billion is now in the government’s grip, with more frozen behind it. Kim Jong Un still got away with a lot. He got away with a lot less than he planned.