The United States Justice Department announced Thursday that it has seized cloud computing infrastructure linked to a hacking campaign attributed to North Korean actors, which operated under the name FaceStealer. According to the department, the scheme targeted individuals working in cryptocurrency or internet-related fields between early 2023 and mid-2024, stealing over $400 million (€361 million) in digital assets through deceptive video interactions.
Campaign Mechanics: Fake Meetings and Deepfakes
Hackers began by sending meeting invitations from accounts compromised during prior attacks. Once victims joined calls, they recorded their webcam feeds and played pre-recorded clips of known contacts—people the target trusted—to create a false sense of authenticity. The FBI notes that these deepfake videos increasingly feature AI-generated avatars of prominent crypto figures to appear more credible.
After establishing trust, hackers staged fake technical errors and offered links purportedly for fixing them. These links installed malware on users' devices. In some cases, attackers waited months or over one year before initiating fund transfers. After stealing funds, they used connections within the victim's network to identify new targets, enabling an expanding attack chain.
Binance Breach: A Separate Incident
The U.S. government has stated it holds court approval to seize more than $1.2 billion taken from cryptocurrency exchange Binance in a separate incident that occurred around October 29 of last year. The FBI attributes this breach to a group known as TraderTraitor, which is distinct from FaceStealer and not linked to North Korean military hackers.
Cryptocurrency giant Binance was reportedly targeted with over $6.3 billion (€5.7 billion) stolen, according to the Associated Press. Since then, U.S. agencies and private firms have collectively frozen assets exceeding $2.7 billion (€2.44 billion). A forfeiture claim has been filed under federal law; a judge will ultimately determine who may retain any recovered funds.
FBI Attribution and Context
The FBI ties FaceStealer to a hacking cluster known as Sapphire Sleet or UNC1069. This group is separate from North Korean military hackers associated with the Binance heist. While the Justice Department asserts that North Korea finances its illicit programs—including weapons development—through such cryptocurrency theft, it does not confirm direct involvement in either operation.
In response to allegations of state-backed cyber activity, North Korea has denied participation in the Binance breach. No official statement has been issued by any government entity confirming responsibility for these attacks.
Note: The information presented here draws exclusively on publicly available reports and statements attributed to U.S. federal agencies as reported through Deutsche Welle. All claims about actors, operations, or financial figures are directly cited from those sources. No independent verification beyond the published material is conducted herein.