FBI disrupts crypto theft scheme by North Korean hacking group; billions stolen so far - AOL.com

The FBI and the Department of Justice announced the disruption on Thursday, targeting a cloud-based infrastructure used by the North Korean hackers.

The operation resulted in the seizure of more than 900 webcam videos of victims working in the cryptocurrency and Web3 industries worldwide.

Before the infrastructure was taken down, the scheme resulted in the theft of more than $400 million over an 18-month period.

FaceStealer scheme details

The hackers used a sophisticated social engineering scheme dubbed "FaceStealer" to compromise victims.

The scheme involves hijacking LinkedIn, Telegram, Slack and Discord accounts of people known to the victim, then impersonating those people to make contact.

Victims are lured into video calls using Zoom, Microsoft Teams and Google Meets. As the victim waits for the call to start, the hackers secretly record them to impersonate them later.

Once the call starts, the impersonator attempts to persuade the victim to download malware, often under the guise of resolving a technical issue.

The FBI says the hackers' objective is the compromise of the software supply chain by infiltrating accounts of trusted developers and maintainers.

TraderTraitor and ongoing recovery efforts

Separately, members of the North Korean military, referred to as "TraderTraitor," stole more than $6 billion in cryptocurrency from the world’s largest crypto exchange Binance on Oct. 29.

Binance has replaced the stolen assets to its customers, but has not recovered the stolen loot.

Federal authorities have worked closely with private companies to recover the stolen funds, freezing more than $2.7 million and obtaining court approval to seize or restrict access to $1.2 billion of that amount.

FBI officials said efforts to trace, freeze, seize and forfeit the stolen virtual assets are ongoing.

The agency also put out a flash alert on its website to inform the public of the FaceStealer campaign.