The US Department of Justice targets North Korea cryptocurrency theft, seizing over $1.2 billion in stolen Binance assets and disrupting FaceStealer.
The US Department of Justice has moved against North Korea’s cryptocurrency theft operations, seizing infrastructure behind fake video calls linked to more than $400 million in losses and obtaining court authorization to seize or restrain more than $1.2 billion stolen from Binance. The coordinated actions target two separate campaigns: the FaceStealer social engineering scheme and a multibillion-dollar exchange theft attributed to North Korean military hackers.
Summary
Key takeaways
- FaceStealer has stolen more than $400 million over 18 months, the FBI says.
- Authorities seized cloud infrastructure and over 900 victim webcam recordings.
- More than $2.7 billion from the separate Binance theft has been frozen.
Justice Department targets North Korea’s cryptocurrency theft operations
The Justice Department’s actions combine the disruption of FaceStealer’s cloud infrastructure with legal measures against stolen Binance assets. Officials described both efforts as part of a campaign against cryptocurrency theft used to finance North Korea’s government and illicit weapons program.
The U.S. Attorney’s Office for the Central District of California and the FBI’s Los Angeles Field Office led the FaceStealer disruption. Acting on a federal warrant, FBI agents recovered more than 900 webcam recordings involving victims.
Separately, the department obtained authorization covering more than $1.2 billion in Binance assets. That amount is part of the larger pool already frozen, rather than an additional recovery.
How FaceStealer turns video meetings into malware attacks
FaceStealer uses recorded footage, deepfakes and fabricated technical problems to persuade targets to install malware. The FBI says the campaign has stolen more than $400 million in 18 months, targeting cryptocurrency and Web3 workers.
Invitations arrive through fake or hijacked accounts, including accounts taken from earlier victims. Authorities say attackers use imitation versions of Zoom, Microsoft Teams and Google Meet, playing recordings of people the target knows to make the meeting appear legitimate. They also use deepfake videos of influential figures.
The attackers then claim that something is wrong—for example, that the target’s microphone is not working—and offer a link or prompt to repair it. The supposed fix installs malware, giving hackers access to cryptocurrency, communications accounts and other computer infrastructure.
Stolen contact lists and recordings help the attackers approach further victims. In several cases, cryptocurrency theft and account hijacking occurred months to more than a year after the initial compromise.
“It exploits our trust in ubiquitous video conference platforms and valued personal relationships,” said Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office.
The FBI says attackers increasingly target open-source software developers and maintainers, seeking access to their devices and software repository accounts. Authorities described that targeting as apparently intended to enable software supply-chain attacks.
TraderTraitor’s separate theft from Binance
North Korean military members identified by the FBI as TraderTraitor stole more than $6 billion in virtual assets from Binance on or about October 29, the Justice Department said. This theft was separate from FaceStealer.
Binance said hackers used fake job interviews in the attack. US law enforcement attributed the theft to North Korea-linked actors; Pyongyang denied responsibility.
Asset freezes and alerts to crypto service providers
US government agencies and private-sector partners have frozen more than $2.7 billion connected to the Binance theft. Justice Department teams worked with virtual asset service providers to intercept the funds.
Authorities continue tracing stolen assets through cryptocurrency bridges, mixers and exchanges. The FBI, US Secret Service and Internal Revenue Service issued a Cyber Alert urging providers to block transactions involving, or derived from, addresses used to launder the Binance assets.
The FBI also published a FaceStealer report and created a resource website. Together with the Secret Service and IRS Criminal Investigation, the bureau’s Los Angeles Field Office, Cyber Division and Virtual Asset Unit are jointly handling efforts to recover the assets.
Read also: Loopring project shutdown confirmed as Binance and Upbit LRC delisting dates pass
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
