A few days ago, North Korean hackers stole $6.3 billion from Binance, which is busy dealing with the aftermath; over the past two days, the U.S. Department of JusticeAnnounce a series of actions targeting North Korean hackers.: Seize the cloud infrastructure used by the FaceStealer social engineering scam, and obtain court authorization to seize or freeze over $1.2 billion in cryptocurrency stolen from Binance. These two matters are two sides of the same issue: the North Korean government funds its regime and weapons programs through large-scale cryptocurrency theft, with tactics that have expanded from exchanges to individual users and recently even to the open-source software supply chain.
Binance had $6 billion stolen, with one-third recovered.
Start with the largest one by amount. On October 29, North Korean military personnel whom the FBI calls “TraderTraitor” stole more than $6 billion in virtual assets from the Binance exchange. This is the largest single theft in cryptocurrency history. Binance temporarily suspended withdrawals that day. On subsequent recovery progress, the Department of Justice’s figures are: with cooperation between the U.S. government and private-sector entities, more than $2.7 billion has been frozen; the Department of Justice has obtained court authorization to seize or freeze more than $1.2 billion of that.
Note that “obtaining court authorization to seize” and “having recovered” are two different things. The processes of tracing, freezing, seizing, and confiscating are still ongoing, because members of TraderTraitor continue to launder money through various cryptocurrency cross-chain bridges, mixers, and exchanges. Last week, the FBI, together with the Secret Service and the IRS Criminal Investigation Division, issued a cyber alert requiring virtual asset service providers to block transactions involving the relevant addresses. Binance said the stolen $6.3 billion in assets have been fully replenished, but recovery of the stolen funds remains subject to subsequent disclosure.
FaceStealer: Even cybersecurity professionals fall for it
Another operation targeted the social engineering scam “FaceStealer.” The Department of Justice seized cloud infrastructure used by North Korean hackers; the scam has caused more than $400 million in cryptocurrency losses over the past 18 months. The method is this: the hackers first send video conference invitations using accounts of previous victims. After the target joins the meeting, the hackers record the target’s camera feed while playing a pre-recorded video featuring someone the target knows, disguising it as a trusted contact who is actually present, thereby gaining trust. The hackers also use super intelligence technology to create deepfake videos of well-known figures in the cryptocurrency and Web3 industries, making the scam more convincing.
Halfway through a meeting, hackers will pretend there’s a technical glitch—for example, saying they can’t hear the target’s audio—and provide a “fix” link. If you click it, malware is quietly installed on the computer. The hackers can then steal cryptocurrency or use the target’s access privileges to infiltrate other systems. “This social engineering scam is highly deceptive, and even the most experienced, security-conscious users could fall for it,” said Patrick Grandy, Assistant Director of the FBI’s Los Angeles Field Office. “It exploits our trust in ubiquitous video conferencing platforms and valuable personal relationships. If you can’t imagine a scenario in which you’d be fooled, you’re not imagining hard enough.”
From stealing money to polluting open-source software
The most notable new information from this operation is that FaceStealer is no longer targeting only cryptocurrency. The Department of Justice noted that in recent years North Korean hackers have increasingly targeted developers and maintainers of open-source software, attempting to gain access to their devices and the code repository accounts they control. Officials assess that this shift is aimed at launching software supply chain attacks.
Under a federal search warrant, the FBI has seized more than 900 webcam videos from FaceStealer victims. The FBI released a report the same day explaining how the scam works and how to protect against it, and set up a dedicated webpage compiling resources. Losses from stolen cryptocurrency can be calculated, but if a compromised open-source package is referenced by millions of other projects, the scope of impact has no upper limit.
Who is talking about this?
This was a multi-agency coordinated operation, and the official announcement named several officials. M. Scott Proctor, Principal Deputy Assistant Attorney General of the Justice Department’s National Security Division, said: “The North Korean government funds a rogue regime and illegal weapons programs by stealing cryptocurrency. Today’s announcement shows that the United States will counter this corrupt regime’s attempts to profit through cybercrime. The National Security Division will use every available means to seize and return North Korea’s illicit proceeds.”
A. Tysen Duva, Assistant Attorney General for the Criminal Division of the Department of Justice, said that the Computer Crime and Intellectual Property Section ( under the Criminal Division (CCIPSand law enforcement partners immediately froze billions of dollars before the stolen assets could escape law enforcement’s reach, “swiftly and effectively blocking about half of this historic breach.” Brett Leatherman, operations chief of the FBI’s Cyber Division, noted that North Korean hackers have used FaceStealer to aggressively target people in the cryptocurrency and Web3 industries, stealing more than $400 million over the past 18 months.
Things that should be done
The official guidance on protection is clear: do not trust that the person you see in a video meeting is actually that person. FaceStealer’s core tactic is “using images of people you know to gain your trust,” and those images can be pre-recorded or deepfake-generated. Specifically, never follow any “technical glitch fix” link or installation request that appears during a meeting; instead, confirm with the other party through a separate channel. If you suspect you have been a victim, the FBI advises changing credentials from a clean device and noting that the initial compromise may not be exploited until months or even more than a year later.
For developers, the meaning of this news is more direct: as an open-source maintainer, your account is now a target too. Multi-factor authentication and access permission management for code repositories are no longer just a personal cybersecurity issue.
Source: KOCPC Chinese