-
The US Justice Department secures court authorisation to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance in an attack attributed to North Korean military-linked hackers.
-
American authorities disrupt cloud-based infrastructure used in the FaceStealer cybercrime operation, which allegedly stole more than $400 million in cryptocurrency over 18 months.
-
The hackers deployed artificial intelligence-generated deepfakes, stolen identities, and fraudulent video meetings to infiltrate cryptocurrency platforms and target open-source software developers.
-
US authorities and private-sector partners have frozen more than $2.7 billion of the over $6 billion stolen from Binance, while the FBI investigates efforts to launder the remaining assets.
November 14, (THEWILL) – The United States has intensified its crackdown on North Korea’s alleged state-sponsored cybercrime operations, securing court-authorised seizure or restraint of more than $1.2 billion in cryptocurrency stolen from Binance and dismantling infrastructure used in a separate artificial intelligence-enabled fraud network responsible for stealing more than $400 million.
The United States Department of Justice (DoJ), announced the coordinated enforcement actions. It said the operations targeted two major cryptocurrency theft schemes attributed to North Korean government-linked hackers, whose activities have become a significant source of revenue for the country’s regime and its illicit weapons programmes.
According to the DOJ, the actions include the seizure of cloud-based infrastructure deployed in the FaceStealer social engineering campaign, which uses sophisticated artificial intelligence-generated deepfakes and deceptive video conferencing techniques to compromise victims, as well as legal measures to recover digital assets stolen in a separate attack on Binance, one of the world’s largest cryptocurrency exchanges.
DoJ further disclosed that the FaceStealer operation has resulted in the theft of more than $400 million in cryptocurrency over the past 18 months, while North Korean military-linked hackers separately stole more than $6 billion in virtual assets from Binance on or about October 29.
Principal Deputy Assistant Attorney General for National Security, M. Scott Proctor, said North Korea had continued to finance its government and weapons development activities through large-scale cryptocurrency theft.
“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” Proctor said.
He said the latest enforcement actions demonstrated Washington’s determination to prevent the North Korean government from benefiting from cybercrime and ensure the recovery of stolen digital assets.
“The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains,” he added.
Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division said the department’s Computer Crime and Intellectual Property Section (CCIPS), working with law enforcement partners, played a critical role in freezing the stolen Binance assets before the hackers could move them beyond the reach of investigators.
He said the department leveraged its expertise and relationships with the digital asset industry to halt about half of the historic theft.
AI Deepfakes, Stolen Identities Drive $400m FaceStealer Operation
In a separate operation, the US Attorney’s Office for the Central District of California announced the disruption of cloud-based infrastructure used by North Korean hackers in the FaceStealer campaign, which the Federal Bureau of Investigation (FBI) described as a highly sophisticated social engineering scheme.
The hackers, identified by various cybersecurity aliases including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, Advanced Persistent Threat 38 (APT38), BlueNoroff and Stardust Chollima, reportedly relied on stolen accounts and fabricated online identities to lure victims into fraudulent video meetings.
Investigators said the attackers sent meeting invitations through accounts previously compromised from other victims, making the invitations appear to originate from trusted personal or professional contacts.
Once a target joined the meeting, the hackers secretly recorded the person’s webcam video and played prerecorded footage of previous victims known to the target, creating the impression that familiar individuals were participating in the conversation.
The attackers also employed artificial intelligence to generate deepfake videos of prominent and influential personalities, particularly individuals in the cryptocurrency and Web3 industries, to make their deception more convincing.
During the meetings, the hackers typically introduced fictitious technical problems, such as claiming that the target could not be heard, before providing a link or instructions purportedly designed to resolve the problem.
However, the supposed solution secretly installed malicious software on the victim’s computer, giving the attackers access to cryptocurrency holdings, communication accounts, and other computer infrastructure within the victim’s control.
In some reported cases, the hackers did not immediately exploit the compromised devices. Instead, they maintained access for several months, sometimes more than a year, before stealing cryptocurrency or hijacking communication accounts.
The attackers also exploited victims’ contact lists, social media accounts, and messaging applications to identify and approach their personal and professional associates, expanding the reach of the operation.
Assistant Director in Charge of the FBI’s Los Angeles Field Office, Patrick Grandy, described FaceStealer as a particularly dangerous scheme because of its ability to exploit familiar communication platforms and trusted relationships.
“North Korea’s FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security-conscious computer user,” Grandy said.
He said the operation exploited people’s confidence in widely used video conferencing platforms and relationships with individuals they knew and trusted.
“It exploits our trust in ubiquitous video conference platforms and valued personal relationships,” he added.
Grandy warned that the campaign had expanded beyond cryptocurrency theft to target individuals involved in developing and maintaining open-source software, raising concerns about possible attacks on the wider software supply chain.
The FBI said the hackers had increasingly attempted to compromise the computers and software repository accounts controlled by open-source developers, potentially enabling them to introduce malicious code into software used by other organisations and individuals.
As part of the investigation, the FBI, acting under a federal warrant, seized more than 900 webcam videos belonging to victims of the FaceStealer operation.
READ ALSO:
FBI Issues Cybersecurity Warning as Investigation Expands
The FBI has published a detailed cybersecurity advisory explaining how the FaceStealer operation works, the techniques deployed by the hackers and the measures individuals and organisations can adopt to protect themselves.
The advisory also provides guidance on steps victims should take if their computers or communication accounts have been compromised.
The bureau has established a dedicated online resource at www.fbi.gov/facestealer to provide information and updates about the operation. It urged individuals working in cryptocurrency, Web3 and open-source software development to exercise caution when responding to unsolicited video meeting invitations, particularly where participants request that they install software, execute computer commands or follow unfamiliar technical instructions to resolve purported communication problems.
FBI Cyber Branch Operations Director Brett Leatherman said North Korean cyber actors had stolen billions of dollars in recent years to finance the country’s illicit weapons programme.
He said the FaceStealer campaign had aggressively targeted individuals in the cryptocurrency and Web3 sectors, resulting in losses exceeding $400 million in the last 18 months.
“The FBI remains committed to identifying, disrupting, and imposing cost on North Korean actors targeting the virtual asset community,” Leatherman said.
The disruption of the FaceStealer infrastructure was led by Assistant US Attorney Khaldoun Shobaki for the Central District of California and the FBI’s Los Angeles Field Office.
US Freezes $2.7bn From Separate Binance Cyberattack
Separately, the Justice Department disclosed that North Korean military personnel, identified by the FBI as operating under the name TraderTraitor, were responsible for stealing more than $6 billion in virtual assets from Binance on or about October 29.
Following the attack, the Justice Department’s National Security Division, its Criminal Division, the US Attorney’s Office for the District of Columbia, and other law enforcement partners began working with virtual asset service providers (VASPs) to trace, freeze, and recover the stolen cryptocurrency.
The coordinated intervention by US authorities and private-sector partners has so far resulted in the freezing of more than $2.7 billion worth of the stolen assets. Of that amount, the Justice Department said it had obtained court authorisation to seize or restrain more than $1.2 billion.
Assistant Attorney General Duva said the swift intervention of investigators and their partners prevented a substantial portion of the stolen digital assets from moving beyond law enforcement’s reach.
US Attorney Jeanine Ferris Pirro for the District of Columbia said the authorities acted immediately to disrupt the movement of the stolen funds.
“By springing into action at a moment’s notice, we worked together to freeze this massive criminal fraud in its tracks,” Pirro said.
She said the operation demonstrated the determination of American authorities to confront North Korean cybercriminal activities and recover stolen assets.
“The North Korean regime may think they are sophisticated cyber criminals, but we have consistently met them head-on, as we did here seizing more than $1.2 billion of their stolen assets,” she added.
The FBI, working with the US Secret Service (USSS) and the Internal Revenue Service Criminal Investigation Division (IRS-CI), had earlier issued a cyber alert attributing the Binance theft to North Korea.
The alert identified cryptocurrency addresses being used by TraderTraitor operatives to launder the stolen assets and urged virtual asset service providers to block transactions involving those addresses or funds derived from them.
Investigators said the hackers were continuing to move the stolen cryptocurrency through various digital asset channels, including cryptocurrency bridges, mixers and exchanges, in attempts to obscure the origin and ownership of the funds.
First Assistant US Attorney Bill Essayli for the Central District of California said cryptocurrency had increasingly become a platform through which North Korea defrauded victims and financed its activities.
“Cryptocurrency unfortunately has become fertile ground for North Korea to defraud victims and fund its malign activities,” Essayli said.
He said the latest seizure demonstrated America’s resolve to pursue criminal operations through which hostile governments benefited financially from cybercrime.
The FBI’s Los Angeles Field Office, Cyber Division and Virtual Asset Unit are coordinating the efforts to trace and recover the stolen Binance assets in partnership with the US Secret Service and the IRS Criminal Investigation Division.
The Justice Department said investigations and recovery efforts remained ongoing as authorities continued to pursue the stolen cryptocurrency and prevent its conversion or transfer through international digital asset networks.
Felix Ifijeh is a journalist with years of professional reporting experience. Known for his keen news sense, compelling storytelling and commitment to accurate, impactful reporting, he has built a reputation for turning leads into clear, engaging, and well-structured reports that resonate with readers. His work reflects deep newsroom experience and a commitment to accurate, impactful journalism.