DOJ Targets North Korean Cyber Threats, Freezes $2.7B in Stolen Assets

The U.S. Department of Justice announced significant actions on November 13 against North Korean cyber threats, freezing over $2.7 billion in assets linked to a Binance hack and dismantling a North Korean phishing network known as FaceStealer. These coordinated efforts underscore a dual strategy targeting both the illicit proceeds of cybercrime and the infrastructure used to conduct these operations.

The U.S. has frozen more than $2.7 billion in stolen virtual assets, with over $1.2 billion secured under court order for seizure or restraint. This action is part of a broader effort to disrupt North Korea’s ability to fund its regime and weapons programs through illicit cyber activities. The Department of Justice, in coordination with law enforcement partners and virtual asset service providers, aims to recover these stolen funds.

In parallel, the U.S. has dismantled the cloud infrastructure used by North Korea for the FaceStealer phishing scheme. This network has been responsible for over $400 million in cryptocurrency theft in the past 18 months. The FaceStealer operation employs social engineering tactics, including the use of fake video conferencing, to trick victims into downloading malware. This malware is designed to steal cryptocurrency, capture sensitive information such as browser cookies and keystrokes, take screenshots, and provide remote access to compromised systems. The operation has also been observed using real victim webcam videos and deepfake videos for impersonation, aiming to lower victims’ guard.

Beyond direct cryptocurrency theft, the FaceStealer operation poses a significant risk to the open-source software supply chain. Attackers have targeted developers and maintainers of open-source projects, including a maintainer of a popular JavaScript library who was reportedly compromised through a fake Teams meeting. This tactic could allow malicious code to be distributed through legitimate software updates, potentially affecting a wide range of users and systems.

North Korea has denied allegations of involvement in the Binance hack. Kim Yo Jong, through the state-run KCNA news agency, criticized the FBI’s attribution as political provocation. The FBI has issued alerts and provided technical reports detailing the FaceStealer operation, urging virtual asset service providers to block related addresses and transactions. The FBI also recommends users take specific security measures, such as initiating video calls from official applications, verifying invitations through separate communication channels, and moving assets to a new wallet if a compromise is suspected.

Uncertainty remains regarding the exact amount of stolen assets that may be ultimately recovered and returned to victims, as well as the specific names of the compromised JavaScript libraries and Rust packages. The full extent of North Korea’s involvement in open-source software supply chain attacks is also not yet fully understood. These actions highlight the evolving sophistication of North Korean cyber operations and the ongoing challenges in combating state-sponsored cyber threats that impact both financial systems and critical digital infrastructure.

This event matters because the U.S. Department of Justice’s actions demonstrate a coordinated international effort to combat sophisticated state-sponsored cyber threats, targeting both illicit proceeds and operational infrastructure. The implications extend to the security of cryptocurrency and open-source software supply chains, underscoring the need for vigilance against evolving cybercrime tactics.

Why This Matters

The materials describe a narrow update: The U. The exact amount of stolen assets that may be ultimately recovered and returned to victims.

Broader Context

Source materials place the factual news in this context: North Korea has previously denied allegations of involvement in the Binance hack.