The key facts

  • The US Department of Justice seized hackers' cloud infrastructure used in the FaceStealer video scheme, which caused over $400 million in losses over 18 months
  • Court approval was obtained to seize or freeze more than $1.2 billion of the over $6 billion stolen from Binance
  • The FBI seized more than 900 webcam videos of victims; over $2.7 billion in assets has been frozen

What happened

The US Department of Justice announced two measures against North Korean hackers. First, cloud infrastructure serving a social engineering scheme that the FBI calls FaceStealer has been seized: according to the agency, it brought the hackers more than $400 million (€361 million) in cryptocurrency over 18 months. Second, a court order was obtained to seize or freeze more than $1.2 billion in cryptocurrency stolen in the hack of the Binance exchange.

How the FaceStealer scheme worked

According to the Justice Department's description, the hackers sent video meeting invitations from the hacked accounts of previous victims. When the target joined, they recorded their video via webcam and played back a pre-recorded clip of a person familiar to them, creating the appearance of a trusted contact's presence. Then a technical error was staged, and an 'fix' via a link installed malware. In some cases, the hackers waited months or more than a year before stealing funds, and then used the victim's contacts to find new targets. The FBI notes that the hackers are beginning to use AI-generated deepfakes featuring images of well-known figures in the crypto industry. The scheme is linked to the hacker cluster Sapphire Sleet (UNC1069), which, according to the agency, is separate from the North Korean military hackers accused of the Binance hack. Under a federal warrant, the FBI seized more than 900 webcam videos of victims. 'If you cannot imagine a scenario in which you could become a victim, you are not thinking creatively enough,' said Patrick Grandy, head of the FBI's Los Angeles field office.

Who was targeted and what about Binance

Most targets work in the crypto industry and related online sectors; the hackers increasingly target open-source developers, which, according to the agency's assessment, may open the way to attacks through software supply chains. The Binance hack, according to the Justice Department, was carried out by the TraderTraitor group around October 29, stealing more than $6 billion; the AP agency estimates the amount at approximately $6.3 billion and calls it the largest cryptocurrency theft in history. Through joint efforts of government agencies and private companies, more than $2.7 billion has been frozen. Recovery of funds is ongoing: the hackers launder them through crypto bridges, mixers and exchanges; usually the authorities file a forfeiture claim, after which a judge decides who is entitled to the return of the funds. 'The North Korean government finances its criminal regime and illegal weapons program through cryptocurrency thefts,' said M. Scott Proctor, Deputy Assistant Attorney General for National Security. North Korea denies involvement in the Binance hack.