DOJ takes aim at $1.2B in Binance loot as FBI disrupts North Korean scam

‘FaceStealer’ scam tied to $400M+ theft, 900+ webcam recordings

The US government on Thursday said it had obtained court authorization to seize or restrain use of over $1.2 billion stolen during last month's $6.3 billion Binance heist, as part of a larger effort to disrupt North Korea's ongoing cryptocurrency theft.

The court also allowed the takedown of cloud-based infrastructure used in a Democratic People’s Republic of Korea (DPRK) social engineering scheme called “FaceStealer” that has amassed more than $400 million in the last 18 months.

It’s called FaceStealer because it involved secretly recorded webcam videos. Victims are typically people working in the cryptocurrency and web3 industries, along with open source software developers and maintainers who DPRK hackers target in the hope of accessing the software repositories they control as the first step towards creating supply chain attacks.

REG AD

900+ faces stolen

REG AD

The FBI said it had seized more than 900 webcam videos belonging to these tech workers.

Here’s how the attack works.

First, the North Koreans send targets an invitation to join a video meeting. Those invitations come from hijacked accounts that the next intended victim may find familiar or credible.

“You're going to think it's real because it's going to be based on either conversations or interests you've expressed in the past with this actual person,” said special agent Jeremy Robertson, who oversees counterintelligence and cyber investigations at FBI Los Angeles.

“They're going to then send you a link to catch up, and it's usually a calendar invite, and it's going to have some typo-squatted URLs in there,” he told reporters on Thursday.

The URL directs the victim to a fake Zoom or Teams meeting, and the cybercriminals record the target’s webcam video while playing a phony, prerecorded video of the person who purportedly sent the meeting invite.

Sometimes the hackers also use deepfake videos of well-known individuals in the cryptocurrency and web3 industries, we’re told.

“When you log in, whoever invited you – your friend or business associate – is going to be on the screen, but you're not going to hear any audio,” Robertson said. “But you're going to see their face, you're going to see them looking around, you're going to see them mouthing some words, and then in the text box you're going to receive some instructions.”

REG AD

‘You’re on mute’ as a social engineering vector

The text box tells the victim that the person on the other end of the video call can’t hear them, they need to upgrade their software for the audio to work properly, and it sends a link to the supposed fix.

Clicking to access the “fix” installs cryptocurrency-stealing malware on the victim’s computer and sends their contact list to the digital thieves to perpetuate the scam.

The FBI attributes FaceStealer to a North Korea-linked group tracked as Sapphire Sleet, which is widely regarded as a Lazarus Group offshoot. Sapphire Sleet is also known as UNC1069, Stardust Chollima, APT38, and BlueNoroff.

“The actors behind this activity, commonly referred to as Sapphire Sleet and other associated names, are part of a broader North Korean effort to generate revenue for the regime, to steal virtual assets, and gain access to networks and trusted online ecosystems,” Brett Leatherman, assistant director of the FBI's Cyber Division, told reporters. “North Korean hackers are increasingly blending cyber intrusion, social engineering, and emerging technologies such as deep fakes to make their impersonation efforts more convincing and scalable.”

Binance heist update

The FBI also provided an update on its efforts to recover the stolen assets from the October 29 attack on Binance. The agency previously blamed the $6.3 billion heist on TraderTraitor, a North Korean hacking operation also linked to Lazarus Group.

Last week, Binance revealed the attackers laid the groundwork for their “sophisticated, multi-stage campaign” back in June, and said it involved social engineering during fake job interviews, malware downloads, compromised internal AI tooling, endpoint takeover, and an “advanced transaction-authorization method.”  

REG AD

Since the theft, federal investigators and private-sector partners have helped freeze more than $2.7 billion in stolen assets. The Justice Department's court authorization covers more than $1.2 billion of that haul.®