North Korean Hackers Behind $6.3B Binance Heist: FBI Uncovers FaceStealer Scheme
The FBI seized over $1.2B in stolen crypto and exposed "FaceStealer," a deepfake video-call scheme used by North Korean hackers to drain hundreds of millions.
FBI exposes North Korean crypto scam that used fake video calls and deepfakes to steal $400M+
Federal authorities have seized more than $1.2 billion in stolen cryptocurrency and frozen an additional $2.7 billion, the Department of Justice announced Thursday — revealing in detail how North Korean state hackers used fake video conferences, deepfake technology, and a staged "audio error" to compromise victims' devices.
NY Post Metro reports that the disclosures come in the wake of a record-breaking $6.3 billion hack of Binance, the world's largest cryptocurrency exchange — an attack described by an insider as "the largest bank heist in human history."
FaceStealer: how the scheme worked
The Justice Department identified the social engineering operation as "FaceStealer," naming it after the cloud servers the FBI seized under a federal warrant. Prosecutors said North Korean hackers used the scheme to steal more than $400 million in cryptocurrency over 18 months.
The operation begins when cybercriminals send a video-meeting invitation from a hijacked account belonging to someone the target already knows — a previous victim of the same group. When the new target joins the call, the hackers start recording the victim's webcam feed without their knowledge.
To make the meeting appear legitimate, the attackers play back a pre-recorded video of the account's real owner, or of others the target recognizes. The result is a call that looks like a normal conversation with trusted contacts.
At a chosen moment, the hackers trigger a fake technical problem — typically claiming the target cannot be heard — and send a link or prompt described as a fix for the supposed audio error. That link quietly installs malware on the target's computer, handing the hackers full access to the device, its stored cryptocurrency, and any connected systems.
Under a federal warrant, the FBI seized more than 900 webcam recordings gathered from FaceStealer victims.
Deepfakes and software supply chains
The DOJ said the hackers also construct deepfake videos of well-known figures in the cryptocurrency and web3 industries to make meetings appear more credible. Beyond individual crypto holders, prosecutors said, the group has increasingly targeted developers who build and maintain open-source software — seeking access to software repository accounts those developers control.
Federal prosecutors said that targeting "appears calculated to enable software supply-chain attacks," in which compromised code could reach large numbers of downstream users.
After each successful infection, investigators said, the hackers extracted contact lists, social media data, and messaging app records from the victim's device — generating a fresh pool of potential targets.
In several documented cases, the actual theft or account takeover occurred months to more than a year after the initial malware installation, authorities said.
Officials warn: even experienced users are at risk
"North Korea's FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security-conscious computer user," said Patrick Grandy, assistant director in charge of the FBI's Los Angeles Field Office. "It exploits trust in common video conferencing platforms and personal relationships."
Grandy added: "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."
FBI Cyber Branch Operations Director Brett Leatherman said the hackers have aggressively targeted individuals in the crypto and web3 sectors. The group operates under multiple aliases, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima.
"Cryptocurrency unfortunately has become fertile ground for North Korea to defraud victims and fund its malign activities," said First Assistant U.S. Attorney Bill Essayli for the Central District of California.
M. Scott Proctor, principal deputy assistant attorney general for national security, said the thefts serve a strategic purpose: "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft."
The Binance attack: $6.3 billion in 20 minutes
On Oct. 29, a North Korean hacking group known as TraderTraitor executed the Binance breach in roughly 20 minutes, beginning at 4:30 p.m. ET, by compromising an engineer's laptop. The exchange confirmed the attack was carried out by breaking into internal systems.
In a statement last Friday, Richard Teng, co-CEO of Binance, said the company's security team had "uncovered additional points of breach," indicating the attack involved more than one person and a complex multi-stage operation.
TraderTraitor was also linked to a $1.5 billion heist targeting crypto exchange Bybit last year — at the time the largest such attack on record — before the Binance breach eclipsed it.
Authorities said tracing and recovery efforts are ongoing as the hackers continue moving stolen funds through cryptocurrency bridges, mixers, and exchanges.
Source: NY Post Metro