The U.S. Department of Justice obtained court authorization to seize or freeze more than $1.2 billion connected to crypto thefts.

Court actions and linked thefts

Binance reported a theft of $6.3 billion on 29 October; the FBI links that incident to TraderTraitor, reportedly associated with Lazarus.

Since then, authorities say they have frozen over $2.7 billion in related assets, and the Justice Department moved to take control of more than $1.2 billion.

Another infrastructure takedown

The same court order allowed dismantling cloud infrastructure tied to a separate North Korean scheme the FBI calls FaceStealer, which reportedly generated more than $400 million in eighteen months.

How the scheme operates

According to filings and agency descriptions, victims receive an invitation appearing to come from a known contact and referencing prior conversations to build trust.

• A link takes the recipient to a fake Zoom or Teams page that plays a pre-recorded video of the expected interlocutor.
• That video may be a deepfake of a notable figure in the crypto space and the call typically has no audio.
• A prompt to "update" the conferencing software installs a stealer that exfiltrates wallets and contacts once executed.
• While victims attempt to restore audio, actors reportedly record webcam footage; the FBI recovered more than 900 such recordings.

Targets and supply-chain risk

Reported targets include employees of crypto and web3 companies as well as open-source maintainers, whose repositories can be leveraged for supply-chain attacks.

Compromised developer accounts and tools allow attackers to insert malicious code into software dependencies, increasing downstream risks for projects and users.

Practical precautions

If a video call has no sound and prompts urgent software installation, security guidance is to leave the call immediately and verify the request independently.

Organizations are advised to harden developer accounts, monitor repository changes, and apply multi-factor authentication to reduce exposure to credential theft.