Federal authorities pulled back the curtain on North Korean hackers’ devious methods for stealing hundreds of millions in cryptocurrency while announcing the agency had seized more than $1.2 billion in stolen digital assets.

The revelation comes after state cybercriminals stole $6.3 billion from Binance, the world’s largest crypto exchange, in a theft deemed “the largest bank heist in human history.”

In addition to the billion-dollar seizure, the Department of Justice announced it had also frozen more than $2.7 billion of the stolen funds.

Federal prosecutors also uncovered a separate scheme North Korean hackers used to steal more than $400 million in crypto over 18 months, using fake video calls, deepfakes and a phony “audio error.”

The Justice Department said Thursday that federal authorities seized the cloud servers used in the social engineering scheme, dubbed “FaceStealer.”

As part of the ploy, cybercriminals send a video-meeting invitation from an account they stole from someone the victim knows, who was also the scammers’ previous target.

When the new mark joins the meeting, the hackers secretly start recording their webcam video. To make the call look legitimate, the crooks play a prerecorded video of the previous victim, or of other people the target knows. The setup makes it look as if trusted contacts are on the call.

As the call goes on, the hackers stage a fake technical problem, like claiming the target can’t be heard, and then send a link or prompt to fix it.

That “fix” quietly installs malware on the target’s computer. From there, the victim loses control of the device and everything on it is exposed. The hackers can steal cryptocurrency or use the target’s access to other systems.

The DOJ says the hackers also use “super intelligence” to build deepfake videos of well-known, influential figures, often from the cryptocurrency and web3 industries. The fake videos make the meetings more convincing, authorities said.

Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims.

“Cryptocurrency unfortunately has become fertile ground for North Korea to defraud victims and fund its malign activities,” said First Assistant U.S. Attorney Bill Essayli for the Central District of California.

In several reported cases, the theft or the hijacking of accounts came months to over a year after the initial infection, authorities said.

Federal investigators said the hackers also pulled contact lists, social media and messaging apps from each new victim, giving them a whole new round of people to target.

Beyond crypto holders, the hackers have increasingly gone after people who build and maintain open-source software, the DOJ said. The goal is to reach their devices and the software repository accounts they control.

Federal prosecutors said that targeting “appears calculated to enable software supply-chain attacks,” in which compromised code could spread to many downstream users.

“North Korea’s FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security-conscious computer user,” said Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office.

He said it exploits trust in common video conferencing platforms and personal relationships.

“If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” Grandy said.

FBI Cyber Branch Operations Director Brett Leatherman said North Korean hackers have used the scheme to aggressively target people in the crypto and web3 sectors.

The DOJ said the hackers go by many names, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.

“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, principal deputy assistant attorney general for national security.

On Oct. 29, a North Korean hacking group known as TraderTraitor carried out the record-breaking $6.3 billion hack of Binance wallets within a mere 20 minutes, starting at 4:30 p.m. ET.

The hackers struck the world’s largest cryptocurrency exchange in a lightning-fast theft that an insider has called “the largest bank heist in human history,” breaking in by hacking an engineer’s laptop.

In an update last Friday, Richard Teng, co-CEO of Binance, said the company’s security team had “uncovered additional points of breach,” suggesting a complex attack carried out by more than one person.

Authorities said the tracing and recovery work is continuing as the hackers move stolen funds through cryptocurrency bridges, mixers and exchanges.

TraderTraitor, the North Korean cybercrime group suspected of the Binance attack, was also tied to a $1.5 billion heist targeting crypto exchange Bybit last year, then the largest attack in history.

Download The California Post App, follow us on social, and subscribe to our newsletters

California Post News: Facebook, Instagram, TikTok, X, YouTube, WhatsApp, LinkedIn
California Post Sports Facebook, Instagram, TikTok, YouTube, X
California Post Opinion
California Post Newsletters: Sign up here!
California Post App: Download here!
Home delivery: Sign up here!Page Six Hollywood: Sign up here!