Two weeks after the record Binance breach, the Justice Department announced coordinated actions against North Korea's crypto theft operations. On or about Oct. 29, North Korean military hackers tracked by the FBI as TraderTraitor stole more than $6B in virtual assets from the exchange.

Joint efforts by US agencies and crypto service providers have frozen more than $2.7B of the stolen funds, and the DOJ has court authorization to seize or restrain over $1.2B of that amount.

Separately, the FBI took down cloud infrastructure behind FaceStealer, a scheme that lures Web3 workers into fake video calls using recorded clips of trusted contacts and deepfakes, then installs malware via a fake technical fix. It is linked to more than $400M in thefts over the last 18 months, and agents seized over 900 webcam videos of victims.

Tracing continues as TraderTraitor keeps laundering the remaining Binance funds through bridges, mixers and exchanges. The FBI warns FaceStealer is now also targeting open-source developers, raising the risk of software supply-chain attacks.