Across the long and unsettled history of people trusting one another's faces across a screen, a new kind of deception has taken root: a meeting invitation from a familiar name, a familiar voice, a familiar friend who is not quite there. On a Thursday in November, the United States Justice Department moved against the machinery behind one such scheme, seizing cloud infrastructure that North Korean hackers had used to draw more than $400 million in cryptocurrency from unsuspecting people over eighteen months. In the same breath, it secured court approval to hold or claim more than $1.2 billion c
US Seizes North Korean Hacking Servers in $400M Crypto Scam and Moves to Recover $1.2B from Binance Heist
Victims lost more than $400 million in cryptocurrency, and the FBI seized more than 900 webcam videos of victims under a federal warrant.
"If you can't imagine falling prey to it, you are not thinking creatively enough."
Mark
Why does this one feel different from other crypto hacks?
Mimi
Because the victim does the work. Nobody breaks a lock. A person joins a call, sees someone they trust, and clicks a link to fix a glitch.
Mark
And the trusted face is a recording of a real earlier victim?
Mimi
That's what the Justice Department describes. Hijacked accounts send the invite, and a prerecorded clip of someone the target knows plays on screen. Deepfakes of known crypto figures are now starting to appear too.
Luke
Worth noting that the deepfake part is the FBI saying hackers are "starting" to use them. That's an early signal, not a measured scale.
Mark
The delay is striking. Some waited over a year before stealing.
Mimi
Yes, in some cases. Patience is part of the design. Victims' contacts become the next targets.
Luke
And the $400 million over 18 months is the department's figure. We don't get a breakdown of how many victims or how it was calculated.
Mark
What about the $1.2 billion from Binance?
Mimi
Court approval to seize or restrain it, out of more than $6 billion stolen. The FBI says over $6 billion, the AP says about $6.3 billion. Over $2.7 billion has been frozen.
Luke
Seized isn't returned. A judge still decides who has a rightful claim. And North Korea denies involvement in the Binance hack, so the attribution is the US side's.
Mark
Are the two cases connected?
Mimi
Not operationally. FaceStealer is tied to Sapphire Sleet, or UNC1069, which is separate from the military hackers blamed for Binance.
Luke
What's unknown is how the seized servers affect ongoing operations. The reporting doesn't say.
O Pulso
- A video call that looks like a gathering of friends is, in fact, a trap recording every face that enters it.
- Hijacked invitations and prerecorded decoys spread through victims' contacts, quietly turning each target into the next lure.
- US authorities have seized cloud infrastructure and sought court approval to restrain more than $1.2 billion tied to the Binance hack.
- More than 900 webcam videos have been seized from victims, and the FBI warns that deepfakes of crypto figures could widen the net.
- The fight now moves to courtrooms, where judges must decide who rightfully owns funds that have already been frozen.
Across the long and unsettled history of people trusting one another's faces across a screen, a new kind of deception has taken root: a meeting invitation from a familiar name, a familiar voice, a familiar friend who is not quite there. On a Thursday in November, the United States Justice Department moved against the machinery behind one such scheme, seizing cloud infrastructure that North Korean hackers had used to draw more than $400 million in cryptocurrency from unsuspecting people over eighteen months. In the same breath, it secured court approval to hold or claim more than $1.2 billion connected to the recent Binance theft, a reminder that the digital ledgers of value can be as contested as any border. The episode tells a larger story about how trust, once borrowed and replayed, becomes the easiest thing to steal.
On Thursday the US Justice Department announced that it had seized cloud infrastructure used by North Korean hackers to run a video-call scam called FaceStealer. Over eighteen months, the scheme stole more than $400 million in cryptocurrency. On the same day, the department said it had won court approval to seize or restrain more than $1.2 billion taken in the recent Binance hack.
The scam begins quietly. A meeting invitation arrives from an account the hackers have already taken over from an earlier victim. When the target joins, their webcam is recorded, and a prerecorded clip of a person they know plays, so that trusted contacts seem to be present. The FBI says the hackers are beginning to add AI-generated deepfakes of well-known figures in crypto. Next comes a staged technical problem and a link offered as a fix, which installs malware. Sometimes the thieves wait months or more than a year before taking anything. Inside, they mine the victim's contacts for the next targets.
Most victims work in crypto or other internet fields, and hackers are increasingly targeting open-source software developers, possibly to launch supply-chain attacks. The FBI has seized more than 900 webcam videos of victims under a federal warrant. Patrick Grandy, who leads the FBI's Los Angeles office, warned that anyone who cannot imagine falling for it is not thinking creatively enough.
The FBI links FaceStealer to a group called Sapphire Sleet, or UNC1069, which is separate from the North Korean military hackers blamed for the Binance theft. In that case, the FBI said a group known as TraderTraitor stole more than $6 billion around October 29. US agencies and private firms have since frozen over $2.7 billion. Freezing is not returning, however. Authorities usually file forfeiture claims, and a judge must decide who has a rightful claim. North Korea has denied involvement in the Binance hack. What comes next is the court process over the $1.2 billion and whether deepfakes widen the reach of the video-call scam.
On Thursday the US Justice Department announced that it had seized cloud infrastructure used by North Korean hackers to run a video-call scam that, over 18 months, stole more than $400 million (€361 million) in cryptocurrency. On the same day it said it had won court approval to seize or restrain more than $1.2 billion taken in the recent Binance hack.
The FBI calls the video-call scam "FaceStealer." According to the Justice Department, it begins with a meeting invitation sent from an account the hackers have taken over from an earlier victim. When the target joins the call, the hackers record the target's webcam video and play a prerecorded clip of a previous victim whom the target knows, so that trusted contacts appear to be present. The FBI says the hackers are also starting to use AI-generated deepfakes of well-known figures in the crypto world.
The next step is a staged technical error. The hackers offer a link to "fix" the problem, and the link installs malware, the department said. In some cases they then waited months, or more than a year, before stealing any funds. Once inside, they use the victim's contacts to find the next targets.
Most of the targets work in crypto and other internet-related fields. The department said the hackers are increasingly going after open-source software developers, apparently to enable supply-chain attacks. Under a federal warrant, the FBI seized more than 900 webcam videos of victims. "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough," said Patrick Grandy, who heads the FBI's Los Angeles field office.
The FBI ties FaceStealer to a hacking cluster known as Sapphire Sleet, or UNC1069. That group is separate from the North Korean military hackers blamed for the Binance theft.
In the Binance case, the FBI said the group known as TraderTraitor stole more than $6 billion (€5.4 billion) on or around October 29. The AP put the figure at about $6.3 billion (€5.7 billion) and called it the biggest crypto heist on record. The Justice Department said US agencies and private firms have since frozen more than $2.7 billion (€2.44 billion).
Freezing and seizing are not the same as returning. As the AP reported, authorities usually file a forfeiture claim in court, after which a judge decides who has a rightful claim to the recovered funds. M. Scott Proctor, the department's principal deputy assistant attorney general for national security, said North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft. North Korea has denied involvement in the Binance hack.
What to watch next is the court process over the $1.2 billion in Binance funds, and whether deepfakes of crypto figures widen the reach of the video-call scam.
Citações Notáveis
If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough.— Patrick Grandy, head of FBI's Los Angeles field office
North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft.— M. Scott Proctor, principal deputy assistant attorney general for national security
Quer a matéria completa?
Leia o original em Deutsche Welle ↗