US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance

The Justice Department on Thursday announced coordinated actions against North Korean groups’ campaigns that have stolen billions of dollars in cryptocurrency, seizing cloud infrastructure behind a social engineering scheme known as FaceStealer and the court-authorized seizure of more than $1.2 billion stolen from cryptocurrency exchange Binance.

The larger of the two operations is tied to the theft of more than $6 billion in virtual assets from Binance, which the FBI has attributed to North Korean military hackers it calls TraderTraitor. Investigators working with private virtual asset service providers have frozen more than $2.7 billion of the stolen funds, and courts have authorized the seizure of more than $1.2 billion of that amount. 

A. Tysen Duva, the assistant attorney general in charge of the DOJ’s Criminal Division, said its computer crime section and partners froze the stolen Binance assets “before they got beyond law enforcement reach,” halting “about half of this historic breach.”

The FBI also issued an alert Thursday that detailed the scheme’s mechanics. Hackers known publicly as Sapphire Sleet, BlueNoroff, APT38 and Stardust Chollima hijack accounts on Telegram, LinkedIn, Slack and Discord and invite targets to video meetings. Links lead to typo-squatted domains, hosting imposter versions of Zoom and Microsoft Teams “designed by the hackers to be indistinguishable from the genuine interfaces.”

The infrastructure seized by the FBI contained a library of more than 900 secretly recorded webcam videos that the hackers played to impersonate victims in follow-on attacks. The footage was captured from victims as they waited for video chats to begin. The alert published redacted and blurred examples of the library. Because each compromise yields the next victim’s video and contact lists, the pool of targets and victims “grows exponentially,” the alert warned.