Key Takeaways
- • The Department of Justice announced coordinated actions against North Korea's cryptocurrency theft schemes, including seizure of cloud-based infrastructure used in the FaceStealer social engineering campaign, which has stolen more than $400 million in crypto over the last 18 months.
- • The DOJ obtained court authorization to seize and restrain more than $1.2 billion in cryptocurrency stolen from Binance on or about Oct. 29, attributed to North Korean actors the FBI calls "TraderTraitor."
- • Collective U.S. government and private sector efforts have frozen more than $2.7 billion of the roughly $6 billion stolen from Binance, according to the Justice Department.
- • The FBI published a technical report on the FaceStealer scheme, seized more than 900 webcam videos of victims under a federal warrant, and launched a centralized resource site at fbi.gov/facestealer.
- • Officials say the North Korean government uses crypto theft to fund its weapons program, and the FBI warns the tactics are increasingly aimed at open-source software supply-chain attacks.
Summary
The U.S. Department of Justice announced coordinated actions against North Korea's efforts to finance its government and illicit weapons program through cryptocurrency theft. The measures include the seizure of cloud-based infrastructure used in the FaceStealer social engineering scheme, which the Justice Department says has resulted in the theft of more than $400 million in cryptocurrency, and the court-authorized seizure and restraint of more than $1.2 billion in digital assets stolen from the Binance exchange.
According to the U.S. Attorney's Office for the Central District of California, FaceStealer lures targets into video meetings using accounts stolen from prior victims. Hackers record the target's webcam, play prerecorded video of known contacts, and in some cases use deepfakes of prominent crypto and Web3 figures to build trust. They then introduce a fake technical error and prompt the target to install malware. Several compromises led to theft months or more than a year later, and the hackers also harvested victims' contact lists to target colleagues. Hackers linked to the scheme, publicly known under names including Sapphire Sleet, BlueNoroff, and APT38, have increasingly targeted developers of open-source software, which the FBI assesses is aimed at enabling software supply-chain attacks. Under a federal warrant, the FBI seized more than 900 webcam videos of victims. The FBI also published a report detailing the scheme and recommended protective practices.
Separately, the FBI attributes the roughly $6 billion theft from Binance on or about Oct. 29 to North Korean military actors it calls TraderTraitor. Government and private sector efforts have frozen more than $2.7 billion so far, and the Justice Department has obtained court authorization to seize or restrain over $1.2 billion. Officials said the criminal actors continue to launder funds through cryptocurrency bridges, mixers and exchanges. The FBI recently issued a Cyber Alert urging virtual asset service providers to block transactions linked to the laundering addresses, working with the U.S. Secret Service and IRS Criminal Investigation.
Officials quoted in the announcement, including Principal Deputy Assistant Attorney General M. Scott Proctor, Assistant Attorney General A. Tysen Duva, U.S. Attorney Jeanine Ferris Pirro, and FBI Cyber Branch Operations Director Brett Leatherman, characterized the actions as a sustained effort to deny North Korea access to illicit cryptocurrency proceeds.
According to the U.S. Attorney's Office for the Central District of California, FaceStealer lures targets into video meetings using accounts stolen from prior victims. Hackers record the target's webcam, play prerecorded video of known contacts, and in some cases use deepfakes of prominent crypto and Web3 figures to build trust. They then introduce a fake technical error and prompt the target to install malware. Several compromises led to theft months or more than a year later, and the hackers also harvested victims' contact lists to target colleagues. Hackers linked to the scheme, publicly known under names including Sapphire Sleet, BlueNoroff, and APT38, have increasingly targeted developers of open-source software, which the FBI assesses is aimed at enabling software supply-chain attacks. Under a federal warrant, the FBI seized more than 900 webcam videos of victims. The FBI also published a report detailing the scheme and recommended protective practices.
Separately, the FBI attributes the roughly $6 billion theft from Binance on or about Oct. 29 to North Korean military actors it calls TraderTraitor. Government and private sector efforts have frozen more than $2.7 billion so far, and the Justice Department has obtained court authorization to seize or restrain over $1.2 billion. Officials said the criminal actors continue to launder funds through cryptocurrency bridges, mixers and exchanges. The FBI recently issued a Cyber Alert urging virtual asset service providers to block transactions linked to the laundering addresses, working with the U.S. Secret Service and IRS Criminal Investigation.
Officials quoted in the announcement, including Principal Deputy Assistant Attorney General M. Scott Proctor, Assistant Attorney General A. Tysen Duva, U.S. Attorney Jeanine Ferris Pirro, and FBI Cyber Branch Operations Director Brett Leatherman, characterized the actions as a sustained effort to deny North Korea access to illicit cryptocurrency proceeds.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.