North Korean hackers stole more than $400 million in cryptocurrency over the past 18 months by impersonating trusted contacts, using AI-generated deepfake videos and tricking victims into installing malware through fake video meetings, the FBI said Thursday.
The campaign, known as “FaceStealer,” targeted people working in the cryptocurrency and Web3 industries, as well as developers involved in building and maintaining open-source software.
Hackers sent invitations to video meetings from accounts they had previously stolen from other victims. Once a target joined, they secretly recorded the person’s webcam footage and played prerecorded videos of people the victim knew, making it appear that trusted colleagues or contacts were taking part in the meeting.
The attackers also used AI-generated deepfakes of well-known figures in the cryptocurrency industry to make their identities more convincing.
During the calls, hackers introduced fake technical problems, such as claiming they could not hear the target. They then instructed victims to click a link or follow steps to fix the issue, which secretly installed malware on their computers.
Once inside a victim’s device, the hackers could steal cryptocurrency, access sensitive information and take control of communication accounts. They also used compromised accounts and contact lists to target the victims’ personal and professional connections.
In some cases, the hackers waited months or even more than a year after initially compromising a device before stealing cryptocurrency.
The FBI said the operation has increasingly focused on open-source software developers, with attackers attempting to gain access to their devices and software repository accounts. Investigators believe the effort was intended to enable attacks against software supply chains.
The hackers are associated with several previously identified North Korean cybercrime groups, including Sapphire Sleet, UNC1069, APT38, BlueNoroff and Stardust Chollima.
As part of the investigation, the FBI seized more than 900 webcam recordings of victims and identified cloud-based infrastructure used to carry out the campaign. The Department of Justice (DOJ) announced Thursday that authorities had seized that infrastructure.
In a separate operation, North Korean military-linked hackers known as TraderTraitor were accused of stealing more than $6 billion in cryptocurrency from Binance on Oct. 29. U.S. authorities and private-sector partners have frozen more than $2.7 billion in assets connected to that theft, with the DOJ obtaining court authorization to seize or restrain more than $1.2 billion.
The FBI said North Korea uses large-scale cryptocurrency theft to generate revenue for its government and illicit weapons programs.