✓ Verified by 3+ outlets
DOJ says North Korea's 'FaceStealer' deepfake video-call scam took $400 million in crypto, seizes its infrastructure
Summary
The U.S. Justice Department said Thursday that North Korean hackers stole more than $400 million in crypto over the past 18 months with a scheme the FBI calls FaceStealer, and that it has seized cloud infrastructure used to run it, according to The Block, Decrypt and CoinDesk.
Per the DOJ, the hackers used stolen accounts to invite targets to video calls, played recordings or deepfakes of familiar people, then faked a technical problem and got victims to install malware that could drain wallets or open other systems.
Decrypt reports the DOJ tied the operation to North Korean groups tracked as Sapphire Sleet, BlueNoroff and APT38, and that the hackers have increasingly targeted open-source developers, apparently to enable supply-chain attacks.
The announcement came alongside the department's update that it has court approval to seize more than $1.2 billion from the Oct. 29 Binance hack.
Key facts
- The FBI seized more than 900 webcam videos of FaceStealer victims and issued guidance for those affected, the DOJ said.
- In some cases the theft and takeover of communication accounts came months to more than a year after a computer was first compromised, per the DOJ.
- "It exploits our trust in ubiquitous video conference platforms and valued personal relationships," said Patrick Grandy of the FBI's Los Angeles Field Office.
- The group also generated AI deepfake videos of well-known figures in crypto and related industries to make the ruse more convincing.
- CoinDesk reports federal authorities took down infrastructure used in the FaceStealer scheme, which was used to steal as much as $400 million in crypto.