WASHINGTON — The Justice Department said Thursday it has won court approval to seize or restrain more than $1.2 billion in cryptocurrency that it says North Korean military hackers stole from the Binance exchange.
The department also said it had seized cloud-based infrastructure behind a social engineering scheme the FBI calls “FaceStealer.” Officials say that scheme has led to the theft of more than $400 million in cryptocurrency over the past 18 months.
Both actions target what federal officials describe as North Korea’s practice of financing its government through crypto theft.
“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft.”
Billions frozen after Binance theft
According to the department, members of the North Korean military, whom the FBI refers to as “TraderTraitor,” took more than $6 billion in virtual assets from Binance on or about Oct. 29.
Since then, the National Security Division’s National Security Cyber Section, the Criminal Division’s Computer Crime and Intellectual Property Section and the U.S. Attorney’s Office for the District of Columbia have worked with law enforcement partners and virtual asset service providers to stop the stolen funds.
The department said combined government and private-sector efforts have frozen more than $2.7 billion so far. The $1.2 billion covered by court authorization is part of that amount.
Assistant Attorney General A. Tysen Duva, who heads the Criminal Division, credited his team and its partners with freezing the assets “before they got beyond law enforcement reach.” He said the division halted “about half of this historic breach.”
U.S. Attorney Jeanine Ferris Pirro of the District of Columbia said the agencies “worked together to freeze this massive criminal fraud in its tracks.”
That work is not finished. TraderTraitor actors are still moving the assets through cryptocurrency bridges, mixers and exchanges, the department said, and the effort to trace, freeze, seize and forfeit them continues.
Last week, the FBI, the U.S. Secret Service and the Internal Revenue Service issued a Cyber Alert attributing the theft. In it, the agencies urged service providers to block any transaction involving the addresses the hackers are using to launder the Binance assets, or money derived from those addresses.
How FaceStealer works
The U.S. Attorney’s Office for the Central District of California said FaceStealer depends on secretly recorded videos and deepfakes. Targets get their invitations to video meetings from accounts the hackers stole from earlier victims.
Once someone joins, their webcam is recorded. In later calls the hackers play back footage of earlier victims the target knows, so it looks as if trusted contacts are taking part.
The department said the hackers also use what it called super intelligence, or SI, to make deepfake videos of well-known figures, often from the cryptocurrency and web3 industries. Those videos are also shown in meetings to win the target’s trust.
Mid-call, a technical problem appears — the target is told, for instance, that no one can hear them — along with a link or prompt offered as the fix. The supposed fix secretly installs malware.
Once inside a computer, the hackers can steal cryptocurrency or use the victim’s access to other systems. In several reported cases, they stole crypto and hijacked communication accounts anywhere from several months to more than a year after the first compromise, the department said.
The hackers also went through new victims’ contact lists, social media and messaging apps to go after their personal and professional contacts.
The department said the hackers are publicly known as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, Advanced Persistent Threat 38 (APT38), BlueNoroff and Stardust Chollima.
Open-source developers in the crosshairs
Besides people working in crypto and web3, the hackers have increasingly gone after developers and maintainers of open-source software. They have tried to get into those people’s devices and the software repository accounts they control. The department said this targeting appears designed to make software supply-chain attacks possible.
Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims.
“It exploits our trust in ubiquitous video conference platforms and valued personal relationships,” said Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office. He added that people who can’t picture themselves falling for the scheme are not thinking creatively enough.
Brett Leatherman, operations director of the FBI’s Cyber Branch, said the bureau remains committed to identifying and disrupting North Korean actors who target the virtual asset community, and to imposing costs on them.
First Assistant U.S. Attorney Bill Essayli of the Central District of California said the seizure shows the U.S. “will continue the fight against rogue states who financially gain from cybercrime.”
Resources and recovery
On Thursday, the FBI also published a report on how the scheme works. It includes best practices for protection and steps victims can take after a compromise. The bureau set up a dedicated website as a central hub for information on FaceStealer.
Assistant U.S. Attorney Khaldoun Shobaki of the Central District of California and the FBI’s Los Angeles Field Office led the FaceStealer disruption.
The bureau’s Los Angeles Field Office, Cyber Division and Virtual Asset Unit are leading the FBI’s effort to recover the stolen Binance assets, working with the Secret Service and the IRS.