US Moves to Seize $1.2B Stolen in North Korean Binance Hack - Bitdefender
US authorities have frozen billions in cryptocurrency stolen by North Korean hackers, while dismantling a separate operation that used deepfake video calls to steal hundreds of millions more.
The Nov. 12 announcement reveals the disruption of a North Korean hacking campaign that used fake video meetings, stolen accounts and AI-generated deepfakes to steal more than $400 million. The Justice Department said US authorities and private-sector partners have collectively frozen more than $2.7 billion of the funds stolen in the Binance attack, described as the largest cryptocurrency heist on record.
Billions frozen after record-breaking Binance heist
The announcement comes after hackers stole an estimated $6.3 billion in cryptocurrency in an Oct. 29 attack on Binance. The FBI attributed the unprecedented theft to TraderTraitor, a North Korean hacking operation linked to the country's military.
Investigators have been working with cryptocurrency exchanges, blockchain intelligence companies and other financial service providers to trace and intercept the stolen assets before they disappear into the cryptocurrency ecosystem.
The operation is far from over. According to investigators, TraderTraitor is still trying to launder the stolen funds through cryptocurrency bridges, mixers and exchanges, further complicating recovery.
Fake video calls help steal another $400 million
Alongside the Binance recovery effort, the Justice Department announced the disruption of FaceStealer, a separate North Korean hacking operation. The campaign has allegedly generated more than $400 million in stolen cryptocurrency over the past 18 months by exploiting the trust people place in familiar faces and online meetings.
The hackers typically begin by compromising someone's communications accounts, then use them to invite the victim's contacts to video meetings. Once the target joins, the attackers play prerecorded webcam footage of someone the victim knows, creating the impression that a trusted contact is participating in the call.
The deception is designed to make the meeting look legitimate long enough for the attackers to introduce a fabricated technical problem.
Victims might be told their microphone isn't working, for example, and instructed to follow a link or perform a supposed troubleshooting step. Instead of fixing the problem, the instructions install malware that gives the attackers access to the victim's computer.
Hackers also target software developers
The FaceStealer campaign extends beyond cryptocurrency investors and traders. According to the FBI, North Korean operatives have also been targeting developers and maintainers of open-source software, apparently seeking access to their computers and software repository accounts.
Such access could let attackers tamper with software distributed to other users, potentially turning a single compromised developer into an entry point for a much larger supply-chain attack.
Security warnings for crypto users
The announcement comes amid heightened security concerns surrounding Binance. Earlier this week, the exchange warned iPhone users about a security flaw that could allow malicious applications to access sensitive information stored by other apps, potentially exposing cryptocurrency wallet recovery phrases, private keys and login credentials.
Cryptocurrency users should verify unexpected meeting invitations, never install software to fix meeting errors, protect wallet credentials, secure accounts with strong passwords and multifactor authentication, keep devices updated, and act quickly if they suspect a compromise.
Related
