The DoJ recently announced coordinated actions targeting the Democratic People’s Republic of Korea (DPRK) government’s schemes to generate revenue through cryptocurrency theft.

The measures include the seizure of cloud-based infrastructure used in a North Korean social engineering operation known as “FaceStealer”, which has resulted in the theft of more than $400 million worth of cryptocurrency, as well as the court-authorised seizure and restraint of over $1.2 billion in cryptocurrency stolen from Binance, a virtual currency exchange, the department said in a statement.

The US Attorney’s Office for the Central District of California announced the disruption of cloud-based infrastructure used by North Korean hackers in the FaceStealer campaign, which the FBI described as a highly effective social engineering operation.

The scheme, which relies on secretly recorded webcam videos and artificially generated deepfakes, has resulted in cryptocurrency thefts exceeding $400 million over the past 18 months. It has also involved attempts to compromise individuals working in the open-source software supply chain.

North Korean hacking groups, publicly identified by names including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, Advanced Persistent Threat 38 (APT38), BlueNoroff and Stardust Chollima, have reportedly lured targets into fraudulent video meetings using invitations sent from accounts previously stolen from other victims.

Once a target joins the meeting, the hackers record the individual's webcam footage and play prerecorded videos featuring people known to the victim. This creates the impression that trusted contacts are participating in the meeting, helping the attackers gain the target's confidence.

The hackers also use artificial intelligence to create deepfake videos of prominent and influential figures, particularly those associated with the cryptocurrency and Web3 industries, making the FaceStealer operation more convincing.

During these meetings, the attackers introduce a fabricated technical problem, such as claiming that the target's microphone is not working properly. They then provide a link or instructions purportedly designed to resolve the issue.

However, the suggested fix secretly installs malware on the target's computer, allowing the hackers to compromise the device and steal cryptocurrency or gain access to other computer infrastructure.

In several reported cases, the attackers stole cryptocurrency and hijacked communication accounts months or even more than a year after initially compromising a victim's device.

As part of the operation, the hackers also gained access to victims' contact lists, social media accounts and messaging applications, enabling them to target their personal and professional connections.

Although cryptocurrency and Web3 industry professionals remain key targets, North Korean hackers have increasingly focused on individuals involved in developing and maintaining open-source software. Their apparent objective is to gain access to developers' devices and software repository accounts, potentially enabling wider software supply-chain attacks.

Under a federal warrant, the FBI seized more than 900 webcam videos belonging to FaceStealer victims.

North Korean hackers behind $6 billion Binance theft

Separately, on or about October 29, North Korean military-linked hackers, identified by the FBI as the “TraderTraitor” group, stole more than $6 billion worth of virtual assets from cryptocurrency exchange Binance.

Following the theft, the National Security Division's National Security Cyber Section, the Criminal Division's Computer Crime and Intellectual Property Section, the US Attorney's Office for the District of Columbia and law enforcement partners worked closely with virtual asset service providers (VASPs) to trace and intercept the stolen funds.

Joint efforts by the US government and private-sector partners have so far resulted in the freezing of more than $2.7 billion worth of assets. Of this amount, the Department of Justice has already obtained court authorisation to seize or restrain more than $1.2 billion.

Efforts to trace, freeze, seize and forfeit the stolen cryptocurrency are continuing, as TraderTraitor-linked hackers attempt to launder the assets through cryptocurrency bridges, mixers and exchanges.

Last week, the FBI, in coordination with the US Secret Service (USSS) and the Internal Revenue Service's Criminal Investigation division (IRS-CI), issued a cyber alert formally attributing the theft to North Korea.

The alert urged virtual asset service providers to block transactions involving cryptocurrency addresses used by TraderTraitor actors, including transactions involving funds derived from the stolen Binance assets.