The United States Justice Department announced on Thursday that it has seized cloud infrastructure used by North Korean hackers in a video-call scam that has reportedly stolen over $400 million (£321 million) in cryptocurrency over the past 18 months.
Additionally, the department secured court approval to seize more than $1.2 billion linked to the recent Binance hack.
The scam, dubbed “FaceStealer” by the FBI, involved hackers sending meeting invitations from compromised accounts of previous victims. Once a target joins the call, the hackers record their webcam feed and play a pre-recorded video of someone the target knows, creating the illusion of familiar faces. The FBI has noted that these hackers are increasingly using AI-generated deepfakes of prominent figures in the cryptocurrency space.
To execute their plan, the hackers create a fake technical error and provide a link to “resolve” it, which actually installs malware. In some instances, they waited several months, or even over a year, before stealing funds, then leveraged the victim’s contacts to target new victims.
Most of the victims work in cryptocurrency or internet-related industries, and the hackers have begun to focus on open-source software developers to facilitate supply-chain attacks. The FBI seized over 900 webcam videos of victims under a federal warrant.
Patrick Grandy, head of the FBI’s Los Angeles office, warned, “If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough.”
The FBI links FaceStealer to a hacking group known as Sapphire Sleet, distinct from the North Korean military hackers accused of the Binance theft.
In the Binance incident, the FBI reported that a group called TraderTraitor stole approximately $6 billion (£5.4 billion) around October 29, marking it as the largest cryptocurrency theft to date. US agencies and private firms have since frozen over $2.7 billion (£2.44 billion) of the stolen funds.
Authorities typically submit a forfeiture claim in court, where a judge will determine rightful ownership of the recovered funds.
According to M. Scott Proctor, the department’s principal deputy assistant attorney general for national security, “North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft.” North Korea has denied any involvement in the Binance hack.
