U.S. seizes servers tied to North Korean 'FaceStealer' crypto scam worth $400 million
DOJ says FBI disrupted a scheme called “FaceStealer” that used fake calls, deepfakes and malware to steal crypto from industry insiders.
The United States has seized cloud servers connected to a North Korea-linked scheme that used fake video calls and deepfake technology to steal cryptocurrency worth more than $400 million over an 18-month period, the Department of Justice said on Thursday.
How the scam worked
The FBI has given the fraud the name "FaceStealer." According to the Justice Department, operators sent meeting invitations that appeared to come from profiles taken from earlier victims. When a target joined the call, the attackers recorded the target's webcam feed and played a pre-recorded video of someone the target knew to make the meeting appear trustworthy. Investigators also say the criminals have employed AI-generated deepfakes of public figures in the crypto world.
After convincing the target that a technical problem had occurred, the attackers offered a link to "fix" the issue; that link installed malware. In some cases, the perpetrators waited months or even more than a year before extracting funds, and then used the victim's contact list to find new targets.
Most victims worked in the crypto industry or related internet fields. The Justice Department warned that open-source software developers are increasingly singled out, apparently to enable supply-chain intrusions that can affect many projects and users downstream.
Based on a federal court order, the FBI seized more than 900 webcam recordings from victims. "If you cannot imagine a scenario in which you could fall for this, you are not thinking creatively enough," said Patrick Grandi, head of the FBI field office in Los Angeles.
The FBI links FaceStealer to a hacking group it named "Safajr Slit" or "U-En-Ce 1069," which is said to operate separately from the North Korean military hacking units accused of stealing $6.3 billion from the cryptocurrency exchange Binance. The Justice Department also said it has a court order to seize or block more than $1.2 billion tied to that recent Binance theft. North Korea has denied involvement in the Binance breach.
Photo: press material from the event
