FBI Pulls Plug On North Korean ‘FaceStealer’ Scheme That Swiped $400 Million In Crypto

The FBI cracked down on a North Korean operation to secretly hack tech employees’ webcams and steal hundreds of millions in cryptocurrency from their colleagues on video calls.

North Korean hackers seized employees’ accounts and covertly recorded webcam footage to pose as victims’ trusted contacts, tricking victims into downloading malware, which resulted in more than $400 million in stolen cryptocurrency across 18 months, according to an FBI report posted Thursday. The scheme, which the FBI dubbed “FaceStealer,” has begun to include the use of AI deepfake technology to rob victims, according to a Thursday FBI Flash alert.

The FBI found that the hackers had recorded more than 900 tech workers, whose footage was used to impersonate them, according to the FBI Flash alert.

Jeremy Robertson, FBI special agent in charge of counterintelligence and cyber at the Los Angeles, CA, field office, explained the North Korean FaceStealer operation in a video posted Friday on the FBI’s YouTube channel.

“North Korean hackers send you a message impersonating someone you know, or someone significant in your industry … Next, they lure you into a realistic but imposter Zoom or Teams meeting,” Robertson said in the video.

The hackers record the victim without their knowledge as their wait for the meeting to begin, which the hackers will later use to impersonate them, Robertson explained. The other meeting participant or participants are recordings of other victims.

The hackers then instruct the victim to download malware that enables them to access the victim’s computer, by telling the individual their meeting audio is not working and sending them an “update” to fix it, Robertson said.

The Department of Justice said Thursday it took control of the hackers’ online setup and seized the stolen webcam videos, according to the department’s press release.

“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” Principal Deputy Assistant Attorney General for National Security M. Scott Proctor said according to the press release. “The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.”

“By springing into action at a moment’s notice, we worked together to freeze this massive criminal fraud in its tracks,” Jeanine Ferris Pirro, U.S. attorney for the District of Columbia, said in the release, referring to funds stolen from Binance. “The North Korean regime may think they are sophisticated cyber criminals, but we have consistently met them head on, as we did here seizing more than $1.2 billion of their stolen assets.”

The Justice Department and the FBI did not immediately respond to the DCNF’s requests for comment.

Previously, North Korean military hackers, “TraderTraitor,” looted more than $6 billion in cryptocurrency from Binance on Oct. 29, the press release stated.

A Binance spokesperson told the Daily Caller News Foundation that roughly $6.34 billion worth of digital assets were affected and about $2.85 billion is “frozen or intercepted so far.”

“Our teams continue to work closely with law enforcement, blockchain intelligence firms, issuers and industry partners to trace, freeze and recover additional impacted funds,” the Binance spokesperson said. “Recovery is ongoing and we’ll share further verified updates through official Binance channels.”

The DOJ has court approval to seize or restrain more than $1.2 billion worth of stolen assets, part of over $2.7 billion that authorities as well as private companies have frozen, the press release states.

In another hacking incident using the same FaceStealer scheme, the hackers fooled a developer who helps run a popular piece of free software into downloading malware, according to the FBI alert.

The breach “could easily have resulted in very large-scale victimization,” the FBI said.

The agency knows of several other North Korean attempts to target tech workers, according to the alert.

All content created by the Daily Caller News Foundation, an independent and nonpartisan newswire service, is available without charge to any legitimate news publisher that can provide a large audience. All republished articles must include our logo, our reporter’s byline and their DCNF affiliation. For any questions about our guidelines or partnering with us, please contact licensing@dailycallernewsfoundation.org.