The U.S. Department of Justice has unveiled coordinated actions against North Korea’s cryptocurrency theft operations, targeting both the FaceStealer social engineering campaign and the proceeds of the recent Binance data breach. Authorities seized cloud infrastructure behind FaceStealer, a scheme tied to more than $400 million in stolen crypto, and won court approval to seize and restrain over $1.2 billion taken from the Binance exchange.
Officials say the stolen money keeps Pyongyang’s regime and weapons program running. “North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, Principal Deputy Assistant Attorney General for National Security, adding that the National Security Division “will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.”
How the FaceStealer Scheme Works
The FaceStealer disruption was led by Assistant U.S. Attorney Khaldoun Shobaki of the Central District of California and the FBI’s Los Angeles Field Office. The hackers involved are publicly tracked as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.
They send video meeting invitations from accounts stolen from earlier victims. Once a target joins, they record the target’s webcam and play prerecorded footage of people the target knows, faking the presence of trusted contacts. They also use super intelligence (SI) to build deepfakes of prominent cryptocurrency and Web3 figures. A staged glitch follows, such as a claim that the target can’t be heard, along with a “fix” that secretly installs malware.
In several cases, theft and account hijacking came months to more than a year after the first compromise. The attackers also mined victims’ contacts, social media and messaging apps for new targets, increasingly including open-source software developers and maintainers, in what appears to be groundwork for supply-chain attacks. Under a federal warrant, the FBI seized more than 900 webcam videos of victims.
FBI Cyber Branch Operations Director Brett Leatherman said FaceStealer had driven over $400 million in thefts in 18 months, and pledged to keep “imposing cost on North Korean actors.” Patrick Grandy, Assistant Director in Charge of the FBI’s Los Angeles Field Office, said the scheme exploits trust in video platforms and personal relationships: “If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough.”
The FBI has released a report on the scheme, protective practices and steps for victims, and launched www.fbi.gov/facestealer as a resource hub.
Tracing the Binance Data Breach Funds
Separate from FaceStealer, North Korean military operatives the FBI calls “TraderTraitor” stole more than $6 billion in virtual assets from Binance on or about Oct. 29. Since the Binance data breach, the National Security Division’s National Security Cyber Section, the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS), the U.S. Attorney’s Office for the District of Columbia and other partners have worked with virtual asset service providers (VASPs) to intercept the funds. Government and private sector efforts have frozen more than $2.7 billion, with court authorization already obtained to seize or restrain over $1.2 billion of it.
Assistant Attorney General A. Tysen Duva said CCIPS and its partners froze the assets “before they got beyond law enforcement reach,” halting about half of what he called a historic breach. U.S. Attorney Jeanine Ferris Pirro of the District of Columbia said, “The North Korean regime may think they are sophisticated cyber criminals, but we have consistently met them head on.” First Assistant U.S. Attorney Bill Essayli of the Central District of California described cryptocurrency as “fertile ground” for North Korean fraud.
The work continues as TraderTraitor actors move the stolen assets through bridges, mixers and exchanges. Last week, the FBI, the U.S. Secret Service (USSS) and IRS Criminal Investigation (IRS-CI) issued a Cyber Alert attributing the theft and urging VASPs to block transactions linked to the laundering addresses. The FBI’s Los Angeles Field Office, Cyber Division, and Virtual Asset Unit are coordinating recovery with both agencies.
