North Korean hackers stole more than $400 million in crypto over the past 18 months using fake video calls, the US Justice Department said on Thursday, 12 November.
The department announced the figure as it seized online infrastructure tied to the operation, which the FBI has named “FaceStealer.” The allegations have not been tested in court.
How the scheme worked
According to the Justice Department, the hackers used accounts stolen from earlier victims to invite new targets to video meetings. During the calls, they played pre-recorded webcam footage of people the target already trusted, to make it look as though those contacts were really there. They also created deepfake videos of well-known figures in crypto and related industries.
Once a target trusted them, the hackers faked a technical problem, such as claiming the person could not be heard, and sent a link to “fix” it. The link installed malware.
The attackers then drained crypto wallets or used their access to get into other systems, sometimes waiting months, or more than a year, before striking.
Under a federal warrant, the FBI seized more than 900 webcam recordings of victims. No victims have been named.
Who is behind it
The Justice Department linked the operation to North Korean hacking groups known as Sapphire Sleet, BlueNoroff and APT38, among others. It warned that the groups are increasingly targeting developers of open-source software, apparently so they can attack the wider software supply chain.
The Binance hack
The announcement comes two weeks after the Binance hack, which the FBI has attributed to TraderTraitor, another North Korea-linked group. North Korea has denied involvement.
The Justice Department has received authorisation to seize or restrain more than $1.2 billion of the funds stolen from Binance on 29 October. Binance has said about $2.85 billion of the stolen assets has been frozen or intercepted.
What happens next
The seizure targets the scheme’s infrastructure, but the Justice Department did not say whether any of the $400 million has been recovered. Binance’s own report showed North Korea-linked hackers also use fake job interviews, so crypto workers should treat unexpected meeting links and “fix” downloads with caution.
