US disrupts North Korea's $400 million crypto scam, FBI says

The United States Justice Department said Thursday it had seized cloud infrastructure used by North Korean hackers in a video-call scam that has stolen more than $400 million (€361 million) in cryptocurrency over 18 months.

It also said it had court approval to seize or restrain more than $1.2 billion taken in the recent Binance hack.

What do we know?

The Federal Bureau of Investigation calls the scam "FaceStealer."

According to the Justice Department, hackers sent meeting invitations from accounts taken over from earlier victims. Once a target joins, the hackers record their webcam video and play a prerecorded clip of a previous victim the target knows, so trusted contacts appear to be present. The FBI says hackers are also starting to use AI-generated deepfakes of well-known crypto figures.

The hackers then stage a fake technical error and offer a link to "fix" it, which installs malware, the department said. In some cases, they waited months, or over a year, before stealing funds.

After that, they use the victim's contacts to find new targets.

Who were the targets of the scam?

Most targets work in crypto and other internet-related fields, and the hackers are increasingly going after open-source software developers, apparently to enable supply-chain attacks, the department said.

Under a federal warrant, the FBI seized more than 900 webcam videos of victims.

"If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough," said Patrick Grandy, who heads the FBI's Los Angeles field office.

The FBI ties FaceStealer to a hacking cluster known as Sapphire Sleet or UNC1069. It is separate from the North Korean military hackers blamed for the Binance theft.

What happened to Binance?

In the Binance case, the FBI said the group known as TraderTraitor stole more than $6 billion (5.4 billion euros) on or around October 29. AP put the figure at about $6.3 billion (5.7 billion euros) and called it the biggest crypto heist on record. US agencies and private firms have since frozen more than $2.7 billion (2.44 billion euros), the department said.

Authorities usually file a forfeiture claim in court, after which a judge decides who has a rightful claim to the recovered funds, AP reported.

"North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," said M. Scott Proctor, the department's principal deputy assistant attorney general for national security.