North Korean hackers used a sophisticated scheme called FaceStealer to steal over $400 million in cryptocurrency from workers in the crypto and web3 industries within an 18-month span, according to the US Department of Justice (DOJ). The FBI dismantled FaceStealer’s cloud-based infrastructure and seized more than 900 webcam recordings of victims, the DOJ announced on Thursday.
Hackers deploy deepfake video calls to target crypto professionals
FaceStealer targeted individuals working in crypto and web3 sectors. Hackers first gained access to compromised accounts from previous victims and used these to invite new targets to video calls. During the calls, they played pre-recorded webcam footage of familiar colleagues, making the interaction appear genuine.
The hackers utilized advanced deepfake technologies to generate convincing videos of prominent figures known in the industry, which were then broadcasted during the meetings. These measures were designed to gain the trust of targets and lower their guard.
At a certain point in the conversation, the attackers simulated a technical issue such as audio problems, prompting targets to click on a link or follow a prompt under the guise of fixing the supposed problem. This action would silently install malware on the victim’s computer.
Once infected, the hackers could seize digital assets directly or leverage the victim’s access to facilitate broader attacks on company infrastructure. In many cases, the consequences occurred months or even more than a year after the original breach as the attackers quietly moved through networks and accounts.
“It exploits our trust in ubiquitous video conference platforms and valued personal relationships. If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough.”
Patrick Grandy, assistant director in charge at the FBI’s Los Angeles Field Office, emphasized the innovative nature of the attack and its reliance on exploiting trust.
Expanding threat to open-source developers and crypto ecosystem
Investigators have observed an increasing focus on open-source software developers in recent months. Hackers attacked these individuals by compromising their devices and code repository accounts—an approach believed to facilitate potential supply-chain attacks within the software ecosystem.
The DOJ identified FaceStealer as being operated by a group of North Korean-linked hacking collectives, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima.
In a related case earlier this year, UNC1069 reportedly took over a crypto executive’s Telegram account and lured a target into a fraudulent Zoom meeting. During the call, the attackers pretended to experience audio issues and convinced the victim to execute commands that enabled further compromise.
Mini dictionary: APT38 is a North Korean state-sponsored cyber group specializing in financial theft and operations, associated with significant attacks on financial institutions and cryptocurrency exchanges worldwide.
The FBI published a detailed report on FaceStealer, offering guidance for protection and response. It also launched a dedicated FaceStealer resource website with further information for potential victims.
DOJ seizes over $1.2 billion, tracks additional stolen crypto funds
In addition to its operation targeting FaceStealer, the DOJ obtained court approval to seize or restrain more than $1.2 billion in stolen cryptocurrency, most of which originated from Binance, one of the world’s largest crypto exchanges. Of the affected funds, more than $2.7 billion has been frozen so far.
| Source | Funds stolen | Funds frozen |
|---|---|---|
| Binance | Over $1.2 billion | Over $2.7 billion |
Officials attribute these thefts to TraderTraitor, a North Korean military cyber unit accused of stealing over $6 billion in cryptocurrency around October 29. The regime has denied responsibility for the incidents.
M. Scott Proctor, Principal Deputy Assistant Attorney General for National Security, commented that North Korea continues to finance its government operations and weapons development programs through thefts of cryptocurrency.
TraderTraitor continues laundering stolen Binance funds through crypto bridges, mixers, and exchanges, with law enforcement efforts ongoing to identify, freeze, and recover these assets.
