Federal authorities have exposed the sophisticated tactics North Korean hackers use to steal hundreds of millions of dollars in cryptocurrency, as the government announced the seizure of more than $1.2 billion in stolen digital assets.
The disclosure follows the theft of $6.3 billion from Binance, the world’s largest cryptocurrency exchange. The attack has been described as “the largest bank heist in human history.”
The Department of Justice also said it had frozen more than $2.7 billion connected to the stolen funds.
Federal prosecutors separately uncovered an 18-month campaign in which North Korean hackers stole more than $400 million in cryptocurrency through fake video calls, deepfakes and a bogus “audio error.”
On Thursday, the Justice Department said federal authorities had seized the cloud servers used in the social-engineering operation, which investigators call “FaceStealer.”
In the scheme, cybercriminals send a video-conference invitation from an account taken over from someone the victim knows—often a person who had already been targeted by the hackers.
After the new target joins the meeting, the hackers covertly record the victim’s webcam feed. To make the call seem authentic, they play a prerecorded video of the previous victim or another person known to the target, creating the impression that trusted contacts are participating.
During the conversation, the hackers manufacture a technical problem, such as claiming they cannot hear the victim, then provide a link or prompt supposedly designed to resolve it.
That so-called solution secretly installs malware on the victim’s computer. Once the device is compromised, the hackers can access its contents, steal cryptocurrency and exploit the victim’s credentials to enter other systems.
The DOJ said the hackers also use “super intelligence” to create deepfake videos featuring prominent figures, particularly people in the cryptocurrency and web3 industries. Investigators said the fabricated footage makes the calls appear more credible.
Acting under a federal warrant, the FBI seized more than 900 webcam videos belonging to FaceStealer victims.
“Cryptocurrency unfortunately has become fertile ground for North Korea to defraud victims and fund its malign activities,” said Bill Essayli, first assistant U.S. attorney for the Central District of California.
Authorities said that in multiple cases, the theft or account takeover occurred months—and sometimes more than a year—after the original infection.
Investigators said the hackers also extracted contact lists, social-media accounts and messaging applications from each newly compromised victim, providing a fresh pool of potential targets.
The hackers have increasingly expanded their efforts beyond cryptocurrency users to people who develop and maintain open-source software, according to the DOJ. Their aim is to compromise those individuals’ devices and the repository accounts they control.
Federal prosecutors said the targeting “appears calculated to enable software supply-chain attacks,” allowing malicious code to reach a much broader network of downstream users.
“North Korea’s FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security-conscious computer user,” said Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office.
Grandy said the operation exploits people’s trust in widely used video-conferencing platforms as well as their personal relationships.
“If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” Grandy said.
Brett Leatherman, operations director of the FBI’s Cyber Branch, said North Korean hackers have used the operation to aggressively pursue targets in the cryptocurrency and web3 industries.
The DOJ said the hackers operate under numerous names, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.
“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, principal deputy assistant attorney general for national security.
On Oct. 29, a North Korean group known as TraderTraitor carried out the record-setting $6.3 billion theft from Binance wallets in just 20 minutes, beginning at 4:30 p.m. ET.
The group targeted the world’s largest cryptocurrency exchange in a rapid attack that an insider described as “the largest bank heist in human history.” Investigators said the hackers gained entry by compromising an engineer’s laptop.
In an update last Friday, Binance co-CEO Richard Teng said the company’s security team had “uncovered additional points of breach,” indicating that the complex operation may have involved multiple people.
Authorities said efforts to trace and recover the funds remain underway as the hackers move the stolen cryptocurrency through bridges, mixers and exchanges.
TraderTraitor, the North Korean cybercrime group suspected in the Binance attack, was also linked to a $1.5 billion theft from crypto exchange Bybit last year. At the time, that was considered the largest cryptocurrency attack in history.