Feds announce seizure of $1.2 billion from Binance theft; also takedown of ‘FaceStealer’ tools - The Record from Recorded Future News
U.S. authorities have seized $1.2 billion stolen from cryptocurrency exchange Binance and disrupted North Korean hacking tools used to steal $400 million in crypto.
The seizure represents a significant victory in the fight against cryptocurrency theft, though it accounts for only a portion of the massive breach. Multiple cryptocurrency platforms had frozen $2.7 billion of the stolen funds following the October attack. Assistant Attorney General A. Tysen Duva emphasized the critical role of the Justice Department's Criminal Division in immediately halting about half of this historic breach.
North Korean Connection
Binance and the FBI have attributed the theft to TraderTraitor, a North Korean hacking group responsible for stealing billions in cryptocurrency over the past decade. FBI Cyber Branch Operations Director Brett Leatherman revealed that the North Korean regime "relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years."
Efforts to trace, freeze, seize, and forfeit the stolen virtual assets are ongoing, as TraderTraitor actors continue to launder such assets through various cryptocurrency bridges, mixers, and exchanges.
Laundering Techniques
North Korean hackers are employing increasingly sophisticated methods to launder stolen cryptocurrency. Blockchain intelligence company Elliptic observed that launderers are "creating their own worthless tokens and using them to move stolen cryptoassets through decentralized exchange liquidity pools." This technique prevents direct transfers between wallets holding stolen assets and those receiving them.
Michael Barnhart, a DTEX researcher, explained that TraderTraitor typically offloads stolen funds to Chinese money launderers for a lump sum or percentage. Elliptic noted that North Korea previously used a similar technique last year while laundering the $1.4 billion stolen from Dubai-based crypto platform Bybit.
FaceStealer Campaign
In a separate action, the FBI and Justice Department disrupted cloud infrastructure used by North Korean hackers in the FaceStealer social engineering campaign, which has resulted in more than $400 million in cryptocurrency thefts over the past 18 months. The scheme involves using malicious Zoom or Teams links, pre-recorded videos, and deepfakes to scam victims into downloading malware.
The FBI obtained warrants to seize over 900 webcam videos of FaceStealer victims and has contacted many of them for interviews. The hackers lure targets with Calendly invitations to video meetings from compromised accounts, leading to fake domains with malware. Once in meetings, they play pre-recorded videos to simulate multiple participants and record the target's webcam for future attacks.
Targeting Developers
The FaceStealers have specifically targeted the cryptocurrency industry and developers working on open-source software. The FBI has tracked attempts to compromise maintainers of JavaScript libraries, Node Packet Manager (NPM), and Rust crates. Earlier this year, the scheme nearly lured a maintainer of a "significant open-source JavaScript library into a fake Teams video chat."
The campaign is attributed to APT38, North Korea's leading military hacking group responsible for the 2016 Bank of Bangladesh heist. After its success, APT38 was split into several different arms, including TraderTraitor. The FBI noted that while FaceStealer was highly effective, it's unclear if the method was used to breach Binance.
Related
