news.today
Hello · Register today | LoginHello · My Account[—] [33]
Tech

FBI seizes $1.2bn from Binance hack, disrupts FaceStealer scam

Summarised from 9 outlets · Updated 13 Nov, 16:33 · Archive

US authorities have seized $1.2bn of cryptocurrency stolen from Binance and disrupted a separate North Korean scam that stole $400m using fake video calls.

The US Department of Justice announced Thursday that it had obtained court authorisation to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance. The theft of approximately $6.3 billion from the world's largest crypto exchange occurred in late October and is regarded as the largest crypto heist in history. Collective efforts by US government agencies and private sector partners have resulted in more than $2.7 billion being frozen.

The FBI attributed the Binance theft to North Korean military hackers known as TraderTraitor, an offshoot of the Lazarus Group. Pyongyang has denied the accusation. The Justice Department said it was taking action against what it described as the North Korean government's schemes to fund its regime through massive cryptocurrency theft. Efforts to track and freeze additional assets are ongoing, as the hackers continue to launder stolen funds through various cryptocurrency channels.

In a separate action, the Justice Department announced it had disrupted cloud-based infrastructure used in a social engineering scam known as FaceStealer. This scheme, attributed to North Korean hackers known as Sapphire Sleet or UNC1069, stole more than $400 million in cryptocurrency over 18 months from more than 900 victims.

The FaceStealer scheme uses fake video calls to target victims, particularly those working in cryptocurrency and web3 industries, as well as open-source software developers. Hackers send meeting invitations from accounts hijacked from previous victims and record webcam footage. They then play prerecorded videos, and according to some accounts, AI-generated deepfakes of people the target knows, to make the call appear legitimate.

During the call, the hackers stage a fake technical problem and send a link to fix it, which secretly installs malware on the target's device. This allows the hackers to access the victim's contacts, cryptocurrency and other sensitive information. Some victims do not realise they have been compromised for months or over a year after the initial infection.

The FBI seized more than 900 webcam videos of victims as part of its investigation. Brett Leatherman, assistant director of the FBI's cyber division, said: "The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years." He noted that North Korean hackers are increasingly blending cyber intrusion, social engineering and emerging technologies such as deepfakes to make their impersonation efforts more convincing and scalable.

The FaceStealer scheme is separate from the Binance hack, though both are attributed to North Korean state-sponsored actors. US officials have repeatedly accused North Korea of using cyber schemes to generate revenue for the regime and fund its illicit activities.

FBI seizes $1.2bn from Binance hack, disrupts FaceStealer scam
Image: TechRadar

Comments (0)

How it is being reported

In this story: FBI · North Korea · Binance · Department of Justice · TraderTraitor · Lazarus Group · Sapphire Sleet

This summary was written by AI from the headlines and standfirsts above, and states as fact only what at least two outlets report. How we use AI · Report a problem · Corrections log