FBI disrupts North Korean FaceStealer campaign behind $5 billion Binance hack

In a significant development, federal authorities have obtained authorization to seize over $1.2 billion in funds stolen during the recent $6.3 billion Binance heist, as part of a broader initiative to impede North Korea's cryptocurrency theft operations. This comes as the FBI disrupts a North Korean scam known as "FaceStealer," which has reportedly amassed more than $400 million in the past 18 months.

The FaceStealer scheme involves the surreptitious recording of webcam videos, typically targeting individuals within the cryptocurrency and web3 industries, as well as open-source software developers and maintainers. The attackers often impersonate familiar or credible contacts through hijacked video meeting invitations, aiming to extract sensitive webcam footage while disguising themselves as well-known figures in the crypto industry.

According to the FBI, over 900 webcam videos of these tech workers have been confiscated. The criminal process begins when the North Koreans send victims an invitation to join a video meeting, leading to the installation of cryptocurrency-stealing malware and the dissemination of their contact lists.

The FBI has identified the perpetrators of FaceStealer as a North Korea-linked group identified as Sapphire Sleet, which is believed to be a subsidiary of the Lazarus Group. Assistant Director of the FBI's Cyber Division, Brett Leatherman, highlighted the increasing sophistication of North Korean hackers, who are combining cyber intrusion, social engineering, and emerging technologies such as deepfakes to create more convincing and scalable attacks.

In a separate development, the FBI has also reported on the ongoing efforts to recover the stolen assets from the Binance heist. Since last October, federal investigators and private-sector partners have managed to freeze over $2.7 billion in stolen funds, with the Justice Department's court order covering an additional $1.2 billion of this recovered amount.