[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fA6Zu1fkjgyXKBHKdclTroWTpx70gBnk70Nk3Llb-TuA":3},{"article":4,"iocs":46,"watch_terms":52,"solutions":53,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"54eeb30c-4780-4810-89ca-41ebf2c60574","FBI Says US Seized $1.2 Billion Worth of Cryptocurrency Stolen From Binance","fbi-says-us-seized-1-2-billion-worth-of-cryptocurrency-stolen-from-binance-e4ac87","Also Thursday, the FBI blamed North Korea for a separate social engineering scheme that officials say resulted in the theft of $400 million worth of cryptocurrency. The post FBI Says US Seized $1.2 Billion Worth of Cryptocurrency Stolen From Binance appeared first on SecurityWeek.","The FBI announced the seizure of over $1.2 billion in cryptocurrency stolen from Binance last month, a heist previously attributed to North Korean hacking group TraderTraitor. The U.S. government has now frozen over $2.7 billion of the stolen funds. Separately, the FBI blamed North Korea for a social engineering scheme called FaceStealer, which resulted in the theft of $400 million over 18 months.","US Seizes $1.2B in Crypto Stolen from Binance; North Korea Blamed for Separate $400M Theft","https:\u002F\u002Fwww.securityweek.com\u002Ffbi-says-us-seized-1-2-billion-worth-of-cryptocurrency-stolen-from-binance\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FBinance-hacked.jpeg","2026-11-13T02:28:21+00:00","2026-11-13T03:00:08.184096+00:00",8,[17,20],{"name":18,"type":19},"Binance","vendor",{"name":21,"type":22},"TraderTraitor","threat_actor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":23,"icon":25,"name":26,"slug":27},null,"Nation-state","nation-state",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,50],{"type":40,"value":48,"context":49},"FaceStealer","Social engineering scheme blamed on North Korea",{"type":40,"value":21,"context":51},"North Korean hacking group attributed to Binance heist",[18],{"controls":54,"vendors":139},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":85,"name":86,"problem":87,"products":88},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":114,"name":115,"problem":116,"products":117},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":135,"product_name":136,"url":137,"description":138},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":150},"north-korean-social-engineering-nets-billions-from-crypto-exchange","North Korean Social Engineering Nets Billions From Crypto Exchange","The TraderTraitor group, linked to North Korea, used sophisticated social engineering (FaceStealer) to compromise Binance and steal over $1.2 billion in cryptocurrency, with total frozen funds exceeding $2.7 billion. The root cause lies in human manipulation — attackers deceived employees or insiders into granting access or credentials rather than exploiting a software vulnerability. This matters because even technically hardened platforms can be undone by a single employee falling for a targeted phishing or impersonation attack. The scale of the theft underscores how nation-state actors invest heavily in social engineering as a primary intrusion vector against high-value financial targets.",[145,146,147,148,149],"MITRE ATT&CK T1566: Phishing","NIST CSF 2.0 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed","NIS2 Article 21(2)(g)","NIS2 Article 21(2)(j)","CIS Control 14: Security Awareness and Skills Training (v8)",{"NIS2 Article 21(2)(g)":151,"NIS2 Article 21(2)(j)":152,"MITRE ATT&CK T1566: Phishing":153,"CIS Control 14: Security Awareness and Skills Training (v8)":154,"NIST CSF 2.0 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed":155},"This point requires basic cyber hygiene and staff training, which directly addresses the social engineering vector North Korean actors exploited against Binance personnel.","Mandating multi-factor authentication and secured communications for privileged accounts would have raised the bar against credential theft via FaceStealer.","FaceStealer relied on phishing and social engineering to obtain credentials or access, which is precisely what this technique covers.","A structured training program covering nation-state social engineering tactics — specifically the job-offer lures used by TraderTraitor — is what this control requires and what was evidently insufficient here.","Enforcing least-privilege and dual-authorization controls on high-value transaction accounts would have limited the attacker's ability to move $1.2 billion after gaining initial access."]