FBI Seizes Over 900 Webcam Videos Used in North Korean Cryptocurrency Scams - FinanceFeeds

The operation, known as FaceStealer, used secretly recorded webcam footage, compromised communication accounts and artificial intelligence-generated deepfakes to deceive cryptocurrency holders and industry employees into installing malware. Federal authorities seized cloud infrastructure supporting the campaign and more than 900 videos of victims.

The announcement also detailed a separate enforcement action involving the October 29 Binance hack, in which U.S. authorities secured court authorization to seize or restrain more than $1.2 billion in stolen cryptocurrency. The two operations were attributed to different North Korean hacking groups.

How the Scam Operated

FaceStealer relied on compromised relationships rather than unsolicited messages from unfamiliar accounts. Attackers gained control of victims' communication accounts and used them to invite their contacts to meetings presented as legitimate business conversations.

During these meetings, hackers played prerecorded videos of people known to the targets, creating the appearance that trusted colleagues were participating. The attackers simultaneously recorded new victims, collecting material for subsequent impersonation attempts.

The meetings were staged using fraudulent versions of familiar conferencing services, including Zoom, Microsoft Teams and Google Meet. At a chosen point, attackers introduced an apparent technical problem, instructing victims to follow a link that installed malicious code.

Expanding Targets

The FBI said the campaign has expanded beyond cryptocurrency holders and Web3 businesses to individuals maintaining open-source software projects. Attackers have attempted to compromise developers' devices and accounts associated with software repositories.

Access to these systems could allow malicious changes to enter software used by multiple organizations, creating opportunities for supply-chain attacks. The Justice Department described this activity as attempted compromise rather than confirming successful contamination of software packages.

Binance Hack Details

The Justice Department's announcement also provided an update on the separate October 29 attack against Binance, which resulted in the theft of more than $6 billion in digital assets. Investigators attributed that breach to TraderTraitor, a North Korean hacking operation distinct from FaceStealer.

The Binance attack involved compromised engineering systems and fraudulent recruitment activity, demonstrating how employee-level access can eventually expose exchange infrastructure handling substantial customer assets. Cooperation between government agencies and private cryptocurrency businesses has frozen more than $2.7 billion connected to the Binance theft.

Security Implications

The seizure of FaceStealer infrastructure interrupts part of the operation, but the Justice Department has not established that all associated attackers have been identified or that compromised accounts and devices are secure.

The delayed nature of some thefts creates an additional challenge. A victim whose device was compromised months earlier may retain apparently normal access while attackers continue collecting information or preparing unauthorized transactions.

The FBI has published technical guidance describing the campaign and steps for potential victims. For cryptocurrency firms, the case reinforces the importance of independently verifying unusual meeting requests and restricting software installation privileges.