North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure - Security Affairs
The U.S. Department of Justice has seized over $1.2 billion from North Korean cryptocurrency theft operations, including $6 billion stolen from Binance, and disrupted the FaceStealer hacker infrastructure.
The U.S. Department of Justice announced two coordinated actions against North Korea's cryptocurrency theft operations, seizing over $1.2 billion and disrupting hacker infrastructure. The actions target the Democratic People's Republic of North Korea (DPRK) government's schemes to fund its regime through massive cryptocurrency thefts.
The DOJ seized cloud-based infrastructure used in the FaceStealer social engineering scheme, which has resulted in more than $400 million worth of cryptocurrency thefts. Additionally, the department obtained court-authorized seizures and restraints of more than $1.2 billion worth of cryptocurrency recently stolen from Binance, a major virtual currency exchange.
FaceStealer Scheme Mechanics
FaceStealer, operated by North Korean hackers known as Sapphire Sleet, BlueNoroff, and APT38, has been active for 18 months. The hackers send meeting invitations from compromised accounts, making them appear to come from trusted contacts. During meetings, they play recorded videos of previous victims or use deepfakes of influential figures in the cryptocurrency and Web3 industries.
The North Korean hackers also use super intelligence (SI) to develop deepfake videos of well-known and influential individuals often in the cryptocurrency and web3 industries that make the FaceStealer scheme even more effective.
The hackers then introduce fake technical problems, such as audio issues, and provide links to fix them, which installs malware. In some cases, they waited months or even over a year before stealing cryptocurrency or taking control of accounts. They also use victims' contact lists and social media to identify new targets.
Binance Theft Recovery
Separately, the DOJ has been working since October 29 to freeze and recover $6 billion stolen from Binance by North Korea's TraderTraitor unit. Combined government and private-sector efforts have frozen more than $2.7 billion, with the DOJ authorized to seize or restrain over $1.2 billion of those assets.
TraderTraitor actors continue to launder remaining assets through cryptocurrency bridges, mixers, and exchanges. Last week, the FBI, U.S. Secret Service, and IRS Criminal Investigation issued a joint cyber alert naming the addresses being used and urging cryptocurrency service providers to block transactions involving those addresses.
North Korean cyber actors have used the FaceStealer scheme to aggressively target individuals in the cryptocurrency and Web3 sectors through deceptive social engineering tactics, resulting in the theft of more than $400 million in the last 18 months.
Government Response
The FBI seized more than 900 webcam videos from FaceStealer victims under a federal warrant and published a detailed report on the scheme's mechanics, including best practices for protection. The agency also created a resource page at fbi.gov/facestealer.
The DOJ has repeatedly highlighted how North Korea uses cryptocurrency theft to support its weapons programs. A senior official from the department's National Security Division confirmed that the regime uses these criminal operations to raise money for its weapons program, and the DOJ pledged to use all available legal tools to seize stolen funds and return them to rightful owners.
The FaceStealer campaign demonstrates the sophistication of these attacks, with the FBI noting that the scheme can trick even experienced IT professionals and users who are well aware of cybersecurity risks. Efforts to trace, freeze, seize, and forfeit the stolen virtual assets continue as authorities work to disrupt North Korean cyber operations.
Related
