US disrupts North Korean FaceStealer campaign tied to $400 million in crypto thefts
Victims were sometimes targeted months or over a year after their first compromise, the FBI has warned.
US authorities have disrupted a North Korean social engineering operation, dubbed FaceStealer, that is tied to more than $400 million in cryptocurrency thefts and ran for about 18 months before the underlying cloud infrastructure was seized. Attackers hijacked accounts on messaging and collaboration platforms to lure cryptocurrency workers and open-source developers into video calls, where they played back recordings of people the targets knew, then claimed a technical fault and pushed a malicious 'fix' that installed malware for stealing wallet data and login credentials. Investigators reported finding more than 900 covertly recorded webcam videos, and the FBI warned that victims were sometimes targeted months or over a year after the first compromise. Separately, the Justice Department said the government had frozen over $2.7 billion of the $6.4 billion taken in the Binance heist, with more than $1.2 billion subject to court-authorised seizure or restraint.
Why it matters
The campaign shows that video calls from accounts a person already knows can no longer be taken at face value, since the attackers used replayed recordings of people targets knew and hijacked real accounts to make invitations look genuine. Crypto workers and open-source developers were the main targets, and the FBI's warning that attacks could follow months or more than a year after a first compromise means affected people may need to stay alert long after an initial breach. The seizure of the cloud infrastructure and the separate freezing of more than $2.7 billion from the Binance heist show the US government is pursuing both the tools and the proceeds of these thefts.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.