DOJ disrupts North Korea-linked deepfake crypto theft scheme

The Justice Department said it disrupted infrastructure behind a North Korea-linked operation that used deceptive video calls to steal more than $400 million in cryptocurrency over 18 months. For investors and people working in crypto, the North Korea deepfake crypto theft case is a reminder that a familiar face on a video call is not proof that a request or link is legitimate.

The department announced the action on Nov. 12, saying it seized cloud-based infrastructure used in a campaign the FBI calls FaceStealer. U.S. officials attributed the activity to hackers publicly tracked under several names, including Sapphire Sleet, APT38 and BlueNoroff.

How did the FaceStealer video-call scam work?

According to the Justice Department, attackers began by sending meeting invitations through accounts taken over from earlier victims. When a new target joined, the hackers played recordings of people the target knew, creating the appearance that trusted contacts were participating in the call.

Officials said the group also used AI-generated deepfake videos of prominent people in cryptocurrency and Web3 to reinforce the impersonation. A deepfake is manipulated audio or video made to look or sound like a real person.

The attackers then staged a technical problem, such as claiming the target's audio was not working, the Justice Department said. A link or prompt presented as the solution instead installed malware, malicious software that can give an attacker access to a device. That access could be used to take cryptocurrency or reach other systems available to the victim, according to the department.

The FBI seized more than 900 webcam videos of FaceStealer victims under a federal warrant, according to the Justice Department and reporting by Recorded Future News. The recordings illustrate how each compromised participant could help attackers appear credible to people in that victim's network.

Who did officials say was targeted?

The campaign focused on people in cryptocurrency and Web3, the Justice Department said. It also attempted to compromise people involved with open-source software, code that is publicly available for others to use and modify.

That matters because software developers and maintainers can have access to projects used by many other companies. The Justice Department did not say the campaign had successfully compromised an open-source software supply chain in its announcement, but said such people had been targeted.

How does this relate to the Binance theft?

The FaceStealer action was announced alongside a separate Justice Department move involving cryptocurrency stolen from Binance. The department said it obtained court authorization to seize or restrain more than $1.2 billion in assets tied to that theft.

The FBI said on Oct. 31 that more than $6 billion in virtual assets were taken from Binance on or about Oct. 29 and attributed that distinct activity to a group it calls TraderTraitor. Recorded Future News reported that an FBI agent said it was unclear whether FaceStealer was used in the Binance breach, so the available evidence does not establish a connection between the two incidents.

The Justice Department said its investigation and enforcement action against FaceStealer were part of efforts to disrupt cryptocurrency theft it attributes to North Korean actors. Readers can review the Justice Department announcement for the agency's account of the operation.

This story draws on original reporting from Decrypt.