Over $1.2 billion of the cryptocurrency taken from Binance last month can now be seized or restrained, The Record reported, after the Justice Department won court approval. The theft totalled $6.3 billion. Binance and the FBI blame the North Korean group TraderTraitor. The FBI and Justice Department also said they disrupted cloud systems behind FaceStealer, a scam that stole more than $400 million over the past 18 months.
The FBI has contacted many victims and interviewed them, but says it has not been able to determine who the first victim was. A warrant covers more than 900 webcam videos of victims. An FBI agent said it is unclear whether FaceStealer was used to breach Binance. The Justice Department said efforts to trace the stolen funds are ongoing.
The FBI says the hackers send Calendly invitations to Zoom or Teams meetings from accounts taken from earlier victims. The links lead to fake domains with malware, which can infect a victim before they join. In the call, a fake error, such as claiming the target cannot be heard, prompts a "fix" that installs a cookie harvester, keylogger, screen capturer and backdoor. Because the invite comes from a real, hijacked account, a familiar name proves little. Maintainers and finance staff should check who may install software, not who sent the link.