FBI reveals cunning ruse North Korean hackers used in massive crypto heist as feds claw back $1.2B - New York Post
Federal authorities have revealed North Korean hackers' deceptive methods for stealing cryptocurrency while announcing the seizure of over $1.2 billion in stolen digital assets.
Federal authorities have pulled back the curtain on North Korean hackers' devious methods for stealing hundreds of millions in cryptocurrency while announcing the agency had seized more than $1.2 billion in stolen digital assets. The revelation comes after state cybercriminals stole $6.3 billion from Binance, the world's largest crypto exchange, in a theft deemed 'the largest bank heist in human history.'
In addition to the billion-dollar seizure, the Department of Justice announced it had also frozen more than $2.7 billion of the stolen funds. North Korean hackers stole more than $400 million in cryptocurrency in just 18 months, federal prosecutors said.
FaceStealer scheme
Federal prosecutors uncovered a separate scheme North Korean hackers used to steal more than $400 million in crypto over 18 months, using fake video calls, deepfakes and a phony 'audio error.' The Justice Department said federal authorities seized the cloud servers used in the social engineering scheme, dubbed 'FaceStealer.'
Hackers make the target get on a video call by sending the invite from someone the victim already knows. As part of the ploy, cybercriminals send a video-meeting invitation from an account they stole from someone the victim knows, who was also the scammers' previous target.
If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough.
When the new mark joins the meeting, the hackers secretly start recording their webcam video. To make the call look legitimate, the crooks play a prerecorded video of the previous victim, or of other people the target knows. The setup makes it look as if trusted contacts are on the call.
As the call goes on, the hackers stage a fake technical problem, like claiming the target can't be heard, and then send a link or prompt to fix it. That 'fix' quietly installs malware on the target's computer. From there, the victim loses control of the device and everything on it is exposed.
Sophisticated targeting
The DOJ says the hackers also use 'super intelligence' to build deepfake videos of well-known, influential figures, often from the cryptocurrency and web3 industries. Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims.
Brett Leatherman, FBI Cyber Branch Operations Director, said North Korean hackers have used the scheme to aggressively target people in the crypto and web3 sectors. Federal investigators said the hackers also pulled contact lists, social media and messaging apps from each new victim, giving them a whole new round of people to target.
Beyond crypto holders, the hackers have increasingly gone after people who build and maintain open-source software, the DOJ said. The goal is to reach their devices and the software repository accounts they control. Federal prosecutors said that targeting 'appears calculated to enable software supply-chain attacks,' in which compromised code could spread to many downstream users.
Binance hack details
On Oct. 29, a North Korean hacking group known as TraderTraitor carried out the record-breaking $6.3 billion hack of Binance wallets within a mere 20 minutes, starting at 4:30 p.m. ET. The hackers struck the world's largest cryptocurrency exchange in a lightning-fast theft that an insider has called 'the largest bank heist in human history,' breaking in by hacking an engineer's laptop.
In an update last Friday, Richard Teng, co-CEO of Binance, said the company's security team had 'uncovered additional points of breach,' suggesting a complex attack carried out by more than one person. Authorities said the tracing and recovery work is continuing as the hackers move stolen funds through cryptocurrency bridges, mixers and exchanges.
TraderTraitor, the North Korean cybercrime group suspected of the Binance attack, was also tied to a $1.5 billion heist targeting crypto exchange Bybit last year, then the largest attack in history. The DOJ said the hackers go by many names, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.
Related
