The short version
- North Korea crypto scam FaceStealer, which stole more than $400 million in 18 months through fake video calls, lost its cloud servers and over 900 victim webcam videos to an FBI seizure.
- The DOJ has court approval to seize or restrain more than $1.2 billion of the over $6 billion stolen from Binance, out of more than $2.7 billion frozen so far.
- FaceStealer now also targets open-source software maintainers, which the DOJ says looks aimed at software supply-chain attacks.
The friend on your next video call might be a recording, and the link that fixes his broken audio might be malware.
That is the North Korea crypto scam the FBI just took apart. On Thursday, November 12, the Justice Department announced that agents seized the cloud servers behind FaceStealer, a video-call scheme it says stole more than $400 million in the last 18 months, plus over 900 webcam videos of its victims. In the same release, the department said it already has court approval to seize or restrain more than $1.2 billion of the crypto stolen from Binance.
That is the biggest recovery step yet from the hack we covered in our Binance hack report. So how does FaceStealer work, and how much of Binance’s money is actually coming back?
FBI Los Angeles, which ran the FaceStealer case, posted the warning on Thursday:
The FBI's Los Angeles Field Office is warning today about #FaceStealer, a highly effective social engineering scheme attributed to North Korean hackers that uses imposter versions of popular video conferencing platforms, secretly recorded web cam video, and computer intrusions to
How the North Korea Crypto Scam FaceStealer Works
It starts with a meeting invite from someone you know, sent from an account the hackers stole earlier. Once you join, they record your webcam and play prerecorded video of earlier victims you know, so the call looks like a normal catch-up. The release says they also use “super intelligence” tools to make deepfakes of well-known crypto figures.
Then comes the trap. Someone claims they can’t hear you and sends a link or a prompt to fix it. The fix quietly installs malware. From there the hackers steal crypto, then work through the victim’s contacts, social media and chat apps, which is how one person’s webcam footage ends up as bait for everyone they know.
They are patient, too. In several cases the theft or account takeover came months, and sometimes more than a year, after the first break-in.
The newer targets worry the FBI more. The hackers have been going after people who build and maintain open-source software, aiming for their devices and their code repository accounts. The DOJ says that “appears calculated to enable software supply-chain attacks.” In other words, one hijacked maintainer could slip malicious code into software other people install without a second thought.
The release ties FaceStealer to North Korean groups tracked as Sapphire Sleet, UNC1069, BlueNoroff and APT38, among other names. That is a different crew from TraderTraitor, the unit the FBI blames for Binance.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
Binance Hack Update: How Much of the Money Is Coming Back?
More than $1.2 billion is now under court orders, out of more than $6 billion North Korea stole from Binance on or about October 29.
The DOJ’s National Security Division put both actions in one post, with a line from its deputy chief M. Scott Proctor on why Pyongyang steals crypto in the first place:
Today, the Department of Justice announced coordinated actions against North Korea's government schemes to fund its regime through the massive theft of cryptocurrency.
These actions include the seizure of cloud-based infrastructure used in the FaceStealer social engineering
Government and private-sector efforts have frozen more than $2.7 billion, about 45% of the haul by our count. A freeze only stops the coins from moving; a seizure order lets the government take them, and that is the step the DOJ has now reached for $1.2 billion. A. Tysen Duva, who runs the DOJ’s Criminal Division, said its crypto crime team helped “immediately halt about half of this historic breach.”
The release does not say whether or when any of it goes back to Binance or its users. Binance has already said it will cover user losses.
Pyongyang denies any part in the North Korea crypto heist. Kim Yo Jong called the FBI’s Binance finding “a grave political provocation” earlier this month, as we reported in our Kim Yo Jong piece. Washington’s answer this week was to go after the money.
SIDE TRAIL: Binance Hack Report: A Fake Job Interview Opened the Door
BNB and Bitcoin Price After the Seizure
The news did not lift the market. BNB trades at $639 at the time of writing, down 5.7% in 24 hours and just above the $628 swing low. Bitcoin is at $69,222, down 6%, and the Fear & Greed Index sits at 20, deep in Extreme Fear.
TRAIL MAP: Protecting Your Crypto Accounts: 2FA, Passwords and Phishing
Anyone who clicked an audio “fix” on a strange call can find the FBI’s steps for victims in its FaceStealer report. Patrick Grandy, who heads the FBI’s Los Angeles office, summed up why the scheme works so well: “It exploits our trust in ubiquitous video conference platforms and valued personal relationships.”
VikingXBT has been trading crypto since 2017. The focus is futures, onchain data and automation. Onchain flows get checked before a chart is trusted, and anything repetitive gets automated. VikingXBT built Base Camp's own onchain scanner, which flags bundlers, snipers, dev holdings and wallet clusters in one view, and backtests strategies before trading them.
More from VikingXBT
