Justice Department Disrupts North Korea Crypto Theft: FaceStealer Infrastructure Seized, Over $1.2 Billion in Stolen Binance Assets Cleared for Seizure
The U.S. Department of Justice announced coordinated actions on November 12 against the North Korean government's schemes to fund its regime through the massive theft of cryptocurrency. The actions include the seizure of cloud-based infrastructure used in the FaceStealer social engineering scheme, which has resulted in the theft of more than $400 million worth of cryptocurrency, and court-authorized seizure and restraint of more than $1.2 billion worth of cryptocurrency recently stolen from Binance, a virtual currency exchange.
Principal Deputy Assistant Attorney General for National Security M. Scott Proctor said North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft, and that the National Security Division will use every tool at its disposal to seize and return North Korea's ill-gotten gains. Assistant Attorney General A. Tysen Duva of the Criminal Division said the division's Computer Crime and Intellectual Property Section and law enforcement partners immediately froze billions of dollars' worth of stolen Binance digital assets.
In the FaceStealer action announced in the Central District of California, North Korean hackers known publicly as Sapphire Sleet, APT38, BlueNoroff and Stardust Chollima, among other names, lured targets with video meeting invitations sent from accounts stolen from prior victims, secretly recorded targets' webcam video, and played prerecorded or super intelligence (SI) deepfake videos to impersonate trusted contacts. They then introduced a fake technical error and induced targets to install malware, stealing cryptocurrency or compromising devices. The scheme has stolen more than $400 million in the last 18 months, targeting people in the cryptocurrency and Web3 industries and, increasingly, open-source software developers in an apparent bid to enable supply-chain attacks. Pursuant to a federal warrant, the FBI seized over 900 webcam videos of FaceStealer victims and published a report and resource site on the scheme.
Separately, members of the North Korean military referred to by the FBI as TraderTraitor stole more than $6 billion worth of virtual assets from Binance on or about October 29. Collective U.S. government and private-sector efforts have since frozen more than $2.7 billion, with court authorization already obtained to seize or restrain more than $1.2 billion of that amount. Efforts to trace, freeze, seize and forfeit the stolen assets are ongoing as the actors continue laundering them through bridges, mixers and exchanges.
Source: U.S. Department of Justice
Published by GSM · USA (original Chinese edition)
Photo: 图：美国司法部总部大楼。固定图库联邦核心包，公共领域。 / Photo: U.S. Department of Justice headquarters. Federal core asset pack, public domain.
