The US government on Thursday said it had obtained court authorization to seize or restrain use of more than $1.2 billion stolen in last month’s $6.3 billion Binance heist, while the court also allowed the takedown of cloud-based infrastructure used in a North Korean social engineering scheme known as FaceStealer that has amassed more than $400 million in the last 18 months.
The FBI attributed FaceStealer to Sapphire Sleet, a North Korea-linked hacking group widely regarded as an offshoot of the Lazarus Group. The scheme involved sending victims invitations to fake video meetings from hijacked accounts, secretly recording their webcam feeds, and tricking them into installing cryptocurrency-stealing malware.
Victims were typically people in the cryptocurrency and web3 industries as well as open source software developers. The FBI said it seized more than 900 webcam videos belonging to these tech workers.
“You're going to think it's real because it's going to be based on either conversations or interests you've expressed in the past with this actual person,” said FBI special agent Jeremy Robertson, who oversees counterintelligence and cyber investigations at FBI Los Angeles.
Victims receive a link to a fake Zoom or Teams meeting. The perpetrators play a prerecorded video of the person who purportedly sent the invitation.
“When you log in, whoever invited you - your friend or business associate - is going to be on the screen, but you're not going to hear any audio,” Robertson said. “But you're going to see their face, you're going to see them looking around, you're going to see them mouthing some words, and then in the text box you're going to receive some instructions.”
The text box tells the victim that the person on the call cannot hear them and says they need to upgrade their software. Clicking the link to the supposed fix installs cryptocurrency-stealing malware and sends the victim’s contact list to the attackers.
Brett Leatherman, assistant director of the FBI's Cyber Division, said North Korean hackers are “increasingly blending cyber intrusion, social engineering, and emerging technologies such as deep fakes to make their impersonation efforts more convincing and scalable.”
Since the October 29 Binance theft, federal investigators and private-sector partners have helped freeze more than $2.7 billion in stolen assets. The Justice Department's court authorization covers more than $1.2 billion of that amount. The FBI previously blamed the heist on TraderTraitor, a North Korean hacking operation also linked to the Lazarus Group.
Binance has said the attackers laid the groundwork for the heist back in June, using social engineering during fake job interviews, malware downloads, compromised internal AI tools, and an advanced transaction-authorization method.
Analysis
Why This Matters
- North Korea’s cyber operations have netted hundreds of millions of dollars, providing revenue that bypasses international sanctions and funds weapons programs.
- The FaceStealer scheme illustrates how social engineering and impersonation tactics have become more sophisticated, targeting even professionals familiar with cyber risks.
- The successful asset freeze and infrastructure takedown demonstrate the growing capability of law enforcement to respond to large-scale cryptocurrency theft.
Background
North Korean hacking groups, particularly the Lazarus Group, have been linked to numerous cryptocurrency heists and cyberattacks aimed at generating revenue for the regime. The October Binance heist was one of the largest thefts from a cryptocurrency exchange, drawing prompt action from US authorities. The FBI and other agencies have increasingly worked with private sector partners to trace and freeze stolen digital assets.
Key Perspectives
What to Watch
- Whether additional funds from the Binance heist can be recovered and whether the identity of the hackers can be further established.
- The likelihood of similar social engineering campaigns continuing, possibly with improved countermeasures.
- The impact of the infrastructure takedown on the operations of Sapphire Sleet and related North Korean hacking groups.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- Partly supportedThe headline says the court authorized seizure or restraint of use of $1.2 billion in Binance funds.www.theregister.com - Articles: “The US government on Thursday said it had obtained court authorization to seize or restrain use of over $1.2 billion stolen during last month's $6.3 billion Binance heist”
- SupportedFaceStealer has amassed more than $400 million in the last 18 months.www.theregister.com - Articles: “The court also allowed the takedown of cloud-based infrastructure used in a Democratic People’s Republic of Korea (DPRK) social engineering scheme called “FaceStealer” that has amassed more than $400 million in the last 18 months.”
- SupportedThe court allowed the takedown of cloud-based infrastructure used by the FaceStealer scheme.www.theregister.com - Articles: “The court also allowed the takedown of cloud-based infrastructure used in a Democratic People’s Republic of Korea (DPRK) social engineering scheme called “FaceStealer””
- SupportedThe FBI attributed FaceStealer to Sapphire Sleet, a North Korea-linked group widely regarded as a Lazarus Group offshoot.www.theregister.com - Articles: “The FBI attributes FaceStealer to a North Korea-linked group tracked as Sapphire Sleet, which is widely regarded as a Lazarus Group offshoot.”
- SupportedThe FBI said it seized more than 900 webcam videos belonging to tech workers.www.theregister.com - Articles: “The FBI said it had seized more than 900 webcam videos belonging to these tech workers.”
- SupportedRobertson said, “You're going to think it's real because it's going to be based on either conversations or interests you've expressed in the past with this actual person.”www.theregister.com - Articles: ““You're going to think it's real because it's going to be based on either conversations or interests you've expressed in the past with this actual person,” said special agent Jeremy Robertson, who oversees counterintelligence and cyber investigations at FBI Los Angeles.”
- SupportedRobertson said, “When you log in, whoever invited you - your friend or business associate - is going to be on the screen, but you're not going to hear any audio.”www.theregister.com - Articles: ““When you log in, whoever invited you – your friend or business associate – is going to be on the screen, but you're not going to hear any audio,” Robertson said.”
- SupportedRobertson said, “But you're going to see their face, you're going to see them looking around, you're going to see them mouthing some words, and then in the text box you're going to receive some instructions.”www.theregister.com - Articles: ““But you're going to see their face, you're going to see them looking around, you're going to see them mouthing some words, and then in the text box you're going to receive some instructions.””
- SupportedLeatherman said North Korean hackers are “increasingly blending cyber intrusion, social engineering, and emerging technologies such as deep fakes to make their impersonation efforts more convincing and scalable.”www.theregister.com - Articles: ““North Korean hackers are increasingly blending cyber intrusion, social engineering, and emerging technologies such as deep fakes to make their impersonation efforts more convincing and scalable.””
- SupportedFederal investigators and private-sector partners have helped freeze more than $2.7 billion in stolen assets since the Binance theft.www.theregister.com - Articles: “Since the theft, federal investigators and private-sector partners have helped freeze more than $2.7 billion in stolen assets.”
- SupportedThe Justice Department’s authorization covers more than $1.2 billion of the frozen assets.www.theregister.com - Articles: “The Justice Department's court authorization covers more than $1.2 billion of that haul.”
- SupportedThe FBI previously blamed the Binance heist on TraderTraitor, a North Korean hacking operation also linked to Lazarus Group.www.theregister.com - Articles: “The agency previously blamed the $6.3 billion heist on TraderTraitor, a North Korean hacking operation also linked to Lazarus Group.”
