U.S. cracks down on cryptocurrency scams: “Acquaintance” in video conference may be North Korean hacker

The U.S. Department of Justice said on Thursday (November 12) that it had seized the cloud infrastructure used by North Korean hackers in a video call scam. The scam swindled more than $400 million (€361 million) in cryptocurrency over 18 months.

The U.S. Department of Justice also said it has obtained court approval to seize or freeze more than $1.2 billion in funds stolen in the recent hack of the cryptocurrency exchange Binance.

The FBI calls this scam "FaceStealer."

According to the Justice Department, the hackers used the accounts of earlier hijacked victims to send meeting invitations. Once the target joins the meeting, the hacker records the target's camera footage and simultaneously plays a pre-recorded video clip of a previous victim known to the target, making it appear that a trusted contact is in the meeting. The FBI said hackers also began using artificial intelligence to generate deepfake videos of prominent cryptocurrency figures.

The hackers would then create a fake technical glitch, provide a link to "fix" the glitch, and click the link to install the malware, the Justice Department said. In some cases, they waited months or even more than a year before stealing the funds.

They then use the victim's contacts to find new targets.

The Justice Department said most of the targets worked in cryptocurrency and other internet-related fields. Hackers are increasingly targeting open source software developers, seemingly to launch supply chain attacks.

The FBI, acting on a federal search warrant, seized more than 900 camera videos of the victims.

"If you can't imagine a situation where you might be deceived, you don't have a rich imagination," said Patrick Grandy, Special Agent in Charge of the FBI's Los Angeles Field Office.

The FBI linked FaceStealer to a hacking group called Sapphire Sleet, or UNC1069. This group is not the same group of North Korean military hackers blamed for the Binance theft.

The FBI said that in the Binance case, a gang called Trader Traitor stole more than $6 billion (5.4 billion euros) on or about October 29. The Associated Press put the figure at about $6.3 billion (5.7 billion euros) and called it the largest cryptocurrency theft on record. U.S. agencies and private companies have since frozen more than $2.7 billion (2.44 billion euros), the Justice Department said.

Authorities typically file forfeiture applications in court, where a judge then decides who has legal rights to the recovered funds, the Associated Press reported.

"The North Korean government steals cryptocurrency to fund its rogue regime and illegal weapons programs," said M. Scott Proctor, the Justice Department's principal deputy assistant attorney general for national security affairs.

North Korea denies involvement in Binance hack.