The revelation comes after state cybercriminals stole $6.3 billion from Binance, the world’s largest crypto exchange, in a theft deemed “the largest bank heist in human history.”
asserted
cybercriminals → come → history
In addition to the billion-dollar seizure, the Department of Justice announced it had also frozen more than $2.7 billion of the stolen funds.
asserted
it → announce → funds
Federal prosecutors also uncovered a separate scheme North Korean hackers used to steal more than $400 million in crypto over 18 months, using fake video calls, deepfakes and a phony “audio error.”
asserted
hackers → uncover → calls
The Justice Department said Thursday that federal authorities seized the cloud servers used in the social engineering scheme, dubbed “FaceStealer.”
asserted
authorities → say → scheme
As part of the ploy, cybercriminals send a video-meeting invitation from an account they stole from someone the victim knows, who was also the scammers’ previous target.
asserted
who → send → someone
When the new mark joins the meeting, the hackers secretly start recording their webcam video.
asserted
hackers → join → video
To make the call look legitimate, the crooks play a prerecorded video of the previous victim, or of other people the target knows.
asserted
target → make → people
The setup makes it look as if trusted contacts are on the call.
asserted
contacts → make → call
As the call goes on, the hackers stage a fake technical problem, like claiming the target can’t be heard, and then send a link or prompt to fix it.
asserted
target → go → it
That “fix” quietly installs malware on the target’s computer.
asserted
fix → install → computer
From there, the victim loses control of the device and everything on it is exposed.
asserted
everything → lose → it
The hackers can steal cryptocurrency or use the target’s access to other systems.
asserted
hackers → steal → systems
The DOJ says the hackers also use “super intelligence” to build deepfake videos of well-known, influential figures, often from the cryptocurrency and web3 industries.
asserted
hackers → say → industries
The fake videos make the meetings more convincing, authorities said.
asserted
authorities → make → ?
Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims.
asserted
FBI → seize → victims
“Cryptocurrency unfortunately has become fertile ground for North Korea to defraud victims and fund its malign activities,” said First Assistant U.S. Attorney Bill Essayli for the Central District of California.
asserted
Essayli → become → California
In several reported cases, the theft or the hijacking of accounts came months to over a year after the initial infection, authorities said.
asserted
authorities → report → infection
Federal investigators said the hackers also pulled contact lists, social media and messaging apps from each new victim, giving them a whole new round of people to target.
asserted
hackers → say → people
Beyond crypto holders, the hackers have increasingly gone after people who build and maintain open-source software, the DOJ said.
asserted
DOJ → go → software
The goal is to reach their devices and the software repository accounts they control.
asserted
they → reach → devices
Federal prosecutors said that targeting “appears calculated to enable software supply-chain attacks,” in which compromised code could spread to many downstream users.
uncertain
code → say → users
“North Korea’s FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security-conscious computer user,” said Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office.
asserted
Grandy → deceive → Office
He said it exploits trust in common video conferencing platforms and personal relationships.
asserted
it → say → platforms
“If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” Grandy said.
uncertain
Grandy → imagine → it
FBI Cyber Branch Operations Director Brett Leatherman said North Korean hackers have used the scheme to aggressively target people in the crypto and web3 sectors.
asserted
hackers → say → sectors
The DOJ said the hackers go by many names, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.
asserted
hackers → say → Sleet
“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, principal deputy assistant attorney general for national security.
asserted
Proctor → bankroll → security
The hackers struck the world’s largest cryptocurrency exchange in a lightning-fast theft that an insider has called “the largest bank heist in human history,” breaking in by hacking an engineer’s laptop.
asserted
insider → strike → laptop
In an update last Friday, Richard Teng, co-CEO of Binance, said the company’s security team had “uncovered additional points of breach,” suggesting a complex attack carried out by more than one person.
asserted
team → say → person
Authorities said the tracing and recovery work is continuing as the hackers move stolen funds through cryptocurrency bridges, mixers and exchanges.
asserted
hackers → say → bridges
TraderTraitor, the North Korean cybercrime group suspected of the Binance attack, was also tied to a $1.5 billion heist targeting crypto exchange Bybit last year, then the largest attack in history.
asserted
TraderTraitor → suspect → history
The Aporia
