The U.S. Department of Justice said Thursday that North Korean hackers stole more than $400 million in cryptocurrency over 18 months using a social-engineering scheme dubbed “FaceStealer”, which combined secretly recorded webcam footage with AI-generated deepfakes.
According to the DOJ, hackers lured targets into video conference meetings using accounts stolen from earlier victims, then played prerecorded footage of trusted contacts to simulate their presence. The group also created deepfake videos of well-known crypto industry figures to make the ruse more convincing.
Once a target was at ease, attackers claimed a fake technical glitch and offered a link to fix it; the link installed malware. From there, the hackers could drain crypto wallets or exploit access to other systems, sometimes waiting months or more than a year before striking. The FBI said it seized more than 900 webcam recordings of FaceStealer victims under a federal warrant.
The DOJ tied the operation to North Korean groups known variously as Sapphire Sleet, BlueNoroff and APT38, and warned that hackers are increasingly targeting open-source software developers in an apparent bid to enable supply-chain attacks.
Separately, the Justice Department updated the status of the record-breaking Binance hack. It has obtained court authorization to seize or restrain more than $1.2 billion of the roughly $6.4 billion stolen from the exchange on Oct. 29, part of more than $2.7 billion frozen so far. The FBI attributed that theft to the North Korean group TraderTraitor, and said the regime has been laundering proceeds rapidly, spinning up a new wallet roughly every 25 seconds. North Korea has denied involvement, calling the FBI’s finding a political provocation.
The actions underscore how central crypto theft has become to Pyongyang’s finances. The U.S. recently sanctioned 11 people over a North Korean IT-worker scheme that moved millions in crypto. Officials said efforts to trace and recover the stolen Binance funds are ongoing.
