Key Takeaways
- • The U.S. Justice Department seized more than 900 webcam videos used in North Korea's "FaceStealer" social-engineering operation, which lured victims into video calls and tricked them into installing malware.
- • U.S. authorities obtained a court order to seize more than $1.2 billion in cryptocurrency tied to the record-breaking Binance hack, attributed to North Korean hackers who stole roughly $6.3 billion.
- • Government agencies and blockchain analysts have worked to freeze almost half of the roughly $6.3 billion stolen from Binance in the late-October cyberattack, with the latest $1.2 billion recovery marking a major step.
- • The FBI warned that North Korean hackers are increasingly targeting software developers and maintainers of widely downloaded open-source libraries to inject malicious dependencies.
- • Officials said Pyongyang continues to launder stolen assets through cryptocurrency bridges, mixers, and exchanges, so tracing and forfeiture efforts remain ongoing.
Summary
The U.S. government said Thursday that it had disrupted North Korea's cryptocurrency-theft operations by seizing infrastructure tied to a complex social-engineering campaign and recovering part of the funds Pyongyang stole from Binance, according to a Justice Department statement reported by Cybersecurity Dive. M. Scott Proctor, principal deputy assistant attorney general for national security, said in a statement that "America will fight back against that corrupt regime's effort to profit through cybercrime."
Federal agents obtained court permission to seize more than 900 webcam videos used in the "FaceStealer" operation. In that scheme, North Korean operatives invited targets into video calls, claimed a technical error was interfering with the conversation, and persuaded victims to install software to fix it. The software in fact delivered malicious code used to steal digital currency and commandeer machines. DOJ said the hackers in several reported cases stole cryptocurrency and hijacked communication accounts months to more than a year after the initial compromise, and accessed victims' contact lists, social media, and messaging apps to target their personal and professional contacts. Most victims worked at technology companies, especially cryptocurrency firms, though North Korea has recently begun targeting maintainers of critical open-source packages. Most videos depicted prior victims, but some were AI-generated deepfakes of "well-known and influential individuals," according to the DOJ.
The FBI issued an alert laying out the multistage scheme and recommended safeguards. It described North Korea's sustained effort to compromise a significant open-source JavaScript library that receives tens of millions of downloads per week, in which a maintainer was approached through a video call that appeared to include a trusted contact and was persuaded to install malware enabling malicious dependencies. The bureau said it was aware of several other attempts to target software developers and libraries with significant download volume.
On the financial side, the late-October cyberattack on Binance is considered the most financially devastating incident in the short history of the cryptocurrency industry. Hackers, whom the FBI and private cybersecurity firms have linked to North Korea, stole roughly $6.3 billion in digital currency. Government agencies and blockchain analysts have since worked together to freeze almost half of the stolen funds, and the FBI's recovery of more than $1.2 billion is the latest contribution. The government said efforts to trace, freeze, seize, and forfeit the assets are ongoing, noting that Pyongyang's operatives continue to launder them through cryptocurrency bridges, mixers, and exchanges.
Federal agents obtained court permission to seize more than 900 webcam videos used in the "FaceStealer" operation. In that scheme, North Korean operatives invited targets into video calls, claimed a technical error was interfering with the conversation, and persuaded victims to install software to fix it. The software in fact delivered malicious code used to steal digital currency and commandeer machines. DOJ said the hackers in several reported cases stole cryptocurrency and hijacked communication accounts months to more than a year after the initial compromise, and accessed victims' contact lists, social media, and messaging apps to target their personal and professional contacts. Most victims worked at technology companies, especially cryptocurrency firms, though North Korea has recently begun targeting maintainers of critical open-source packages. Most videos depicted prior victims, but some were AI-generated deepfakes of "well-known and influential individuals," according to the DOJ.
The FBI issued an alert laying out the multistage scheme and recommended safeguards. It described North Korea's sustained effort to compromise a significant open-source JavaScript library that receives tens of millions of downloads per week, in which a maintainer was approached through a video call that appeared to include a trusted contact and was persuaded to install malware enabling malicious dependencies. The bureau said it was aware of several other attempts to target software developers and libraries with significant download volume.
On the financial side, the late-October cyberattack on Binance is considered the most financially devastating incident in the short history of the cryptocurrency industry. Hackers, whom the FBI and private cybersecurity firms have linked to North Korea, stole roughly $6.3 billion in digital currency. Government agencies and blockchain analysts have since worked together to freeze almost half of the stolen funds, and the FBI's recovery of more than $1.2 billion is the latest contribution. The government said efforts to trace, freeze, seize, and forfeit the assets are ongoing, noting that Pyongyang's operatives continue to launder them through cryptocurrency bridges, mixers, and exchanges.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.