World, Cybersecurity & Financial Enforcement
DOJ Distinguishes Seized Infrastructure From Restrained Cryptocurrency
The department describes separate North Korea-related operations. Frozen or restrained assets are not the same as funds returned to victims.
Two operations in one announcement
The Justice Department announced action against cloud infrastructure used in a North Korea-linked social-engineering campaign and separate court-authorized action involving cryptocurrency stolen from Binance. The November 12 release should not be read as describing a single theft with interchangeable totals.
The asset figures measure different steps
For the Binance matter, DOJ says collective public and private efforts froze more than $2.7 billion, with authorization to seize or restrain more than $1.2 billion of that amount. Authorization, restraint, final forfeiture and restitution are different stages. The announcement does not establish that the full frozen amount has been recovered and paid to customers.
A warning about trusted-looking contact
In the separate FaceStealer operation, investigators describe compromised accounts, recorded video and synthetic impersonation used to gain targets’ trust during online meetings. DOJ attributes more than $400 million in theft to that campaign over eighteen months. Those are investigators’ reported findings. The release links FBI guidance for potential victims and says tracing and recovery efforts continue; it does not support a guarantee that any particular stolen balance will be returned.
Primary evidence
Reporting note: This independently composed article is based on the linked primary records. Publication and event dates are stated separately. Agency claims are identified as such; an allegation, charge or scheduled event is not presented as a finding, conviction or completed event. Readers should consult the official record for amendments and later action.