US Targets North Korean Cryptocurrency Theft Operations

The United States government has taken action against North Korea’s cryptocurrency theft operations, seizing digital evidence and recovering more stolen funds from a major Binance cyberattacks.

The US Department of Justice said federal agents obtained court approval to seize more than 900 webcam videos used in a scheme known as FaceStealer. Authorities also secured an order to seize more than US$1.2 billion in cryptocurrency stolen during the October attack on Binance.

US officials said the actions target North Korea’s efforts to use cybercrime to generate revenue and support its activities despite international sanctions.

FaceStealer Used Videos to Trick Victims

North Korean operatives reportedly used the seized videos to deceive people into joining video calls. During these calls, hackers claimed technical problems were preventing communication and encouraged victims to install software to fix the issue.

However, the software contained malicious code that allowed the hackers to steal cryptocurrency and gain access to victims’ devices.

The Justice Department said hackers also accessed victims’ contact lists, social media accounts and communication applications. They then used those connections to target additional individuals.

Most victims worked in technology companies, particularly businesses involved in cryptocurrency. However, North Korean hackers have also started targeting developers and maintainers of widely used open-source software.

Some of the videos featured previous victims, while others contained AI-generated deepfakes of well-known individuals.

US Recovers More Binance Funds

The October cyberattacks on Binance resulted in the theft of approximately US$6.3 billion in digital currency. The FBI and private cyber security companies have linked the attack to North Korea.

Since the incident, government agencies and blockchain analysts have worked to freeze almost half of the stolen funds. The latest recovery of more than US$1.2 billion represents another major development in those efforts.

Authorities said North Korean operatives continue to move stolen cryptocurrency through digital currency bridges, mixers and exchanges to conceal its origins.

The US government confirmed that efforts to trace, freeze and recover the remaining stolen assets are ongoing.