FBI seizes cloud servers behind North Korean 'FaceStealer' crypto scam

North Korean hackers stole more than $400 million (€361 million) in cryptocurrency over 18 months by faking video calls, the US Justice Department said on Thursday, announcing the seizure of cloud infrastructure used in the scheme and court approval to seize or restrain more than $1.2 billion taken in the recent Binance hack.

The FBI calls the operation FaceStealer. According to the department, hackers send meeting invitations from accounts taken over from earlier victims. When a target joins, they record the webcam video and play a prerecorded clip of a previous victim the target knows, so that trusted contacts appear to be present. The FBI says the group is also beginning to use AI-generated deepfakes of well-known crypto figures.

The hackers then stage a fake technical error and offer a link to "fix" it, which installs malware. In some cases they waited months, or more than a year, before stealing funds, and then used the victim's contacts to find new targets. Most targets work in crypto and other internet-related fields, and the department says the hackers are increasingly going after open-source software developers, apparently to enable supply-chain attacks.

Under a federal warrant, the FBI seized more than 900 webcam videos of victims. Patrick Grandy, who heads the FBI's Los Angeles field office, said that "if you can't imagine a scenario where you might fall prey to it," people are not thinking creatively enough about the threat.

The FBI ties FaceStealer to a hacking cluster known as Sapphire Sleet or UNC1069, separate from the North Korean military hackers blamed for the Binance theft. In that case, the FBI said the group known as TraderTraitor stole more than $6 billion (€5.4 billion) on or around October 29; other tallies put the loss at about $6.3 billion (€5.7 billion) and call it the biggest crypto heist on record. US agencies and private firms have since frozen more than $2.7 billion (€2.44 billion).

"North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," said M. Scott Proctor, the department's principal deputy assistant attorney general for national security. North Korea has denied involvement in the Binance hack.