The U.S. Department of Justice has reported that North Korean hackers stole over $400 million in cryptocurrency across the past 18 months through a sophisticated scheme using secretly recorded video and AI-powered deepfakes to impersonate trusted figures during virtual meetings.
FaceStealer Scheme Targets Crypto Firms and Developers
Authorities stated that the social-engineering operation, identified by the FBI as “FaceStealer,” manipulated video calls to compromise victims. Hackers initiated conference calls with stolen accounts from prior victims and played pre-recorded webcam video of reliable contacts to gain trust during conversations.
To increase the scam’s effectiveness, the group generated AI deepfakes of well-known industry figures, further deceiving targets. Once individuals were convinced, the hackers simulated technical issues, such as claiming the participant could not be heard, and then encouraged them to click on a link to “resolve” the problem. The link delivered malware, enabling the attackers to extract funds from crypto wallets or access internal networks, with some breaches remaining undiscovered for over a year.
Hackers lured victims into meetings using stolen accounts and staged webcam footage, then used AI-generated deepfakes and technical ruses to deploy malware and steal funds.
The FBI said it seized more than 900 webcam recordings of FaceStealer victims under a federal warrant, underlining the scheme’s scale and reach.
The Justice Department connected these operations to North Korean groups known as Sapphire Sleet, BlueNoroff, and APT38. Officials warned that these hacking teams are increasingly targeting open-source developers, a strategy that could enable broader supply-chain attacks in the crypto sector.
Mini dictionary: A supply-chain attack is a cyberattack targeting organizations by compromising less secure elements in their supply network, such as open-source software libraries or dependencies, to access broader systems and data.
DOJ Freezes Billions Linked to Binance Hack
Separately, the Justice Department announced new progress in tracing assets linked to the record $6.4 billion hack of Binance, one of the world’s largest cryptocurrency exchanges. Investigators secured court authorization to seize or restrain over $1.2 billion associated with the incident, as part of a total $2.7 billion in frozen assets.
| Event | Amount |
|---|---|
| Total value stolen from Binance | $6.4 billion |
| Assets frozen so far | $2.7 billion |
| Assets DOJ now authorized to seize or restrain | $1.2 billion |
The FBI attributed the Binance theft to a North Korean-linked group known as TraderTraitor. Officials stated that the regime rapidly laundered the proceeds by creating new wallets about every 25 seconds. North Korea has consistently rejected allegations of involvement, and called the FBI’s findings a political provocation.
North Korea Rejects U.S. Allegations, Cites ‘Political Provocation’
North Korea denied any role in the Binance hack, labeling the FBI’s attribution as a “grave political provocation.” In a statement reported by Yonhap and state media, Kim Yo Jong, the sister of North Korean leader Kim Jong Un, said the U.S. misrepresents the regime by blaming it for global cybercrimes.
“It is a grave political provocation against the DPRK that the U.S. misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds,” Kim Yo Jong said, as reported by the Korean Central News Agency.
The DOJ’s crackdown follows a wave of U.S. sanctions targeting North Korean IT workers involved in cryptocurrency laundering. Researchers have highlighted the regime’s reliance on crypto theft as a crucial source of funding.
Law enforcement emphasizes that efforts are ongoing to track and recover the remaining stolen Binance assets.
