Stolen cryptocurrency and digital tools used by North Korean hackers have been seized by U.S. law enforcement this week following last month’s $6.3 billion theft from cryptocurrency platform Binance.
The Justice Department obtained court authorization to seize or restrain more than $1.2 billion that was stolen from Binance during the brazen attack — part of the $2.7 billion total that was frozen by several cryptocurrency platforms following the theft.
Assistant Attorney General A. Tysen Duva said multiple divisions within the Justice Department “played the critical role in immediately freezing billions of dollars’ worth of stolen Binance digital assets before they got beyond law enforcement reach.”
“As the Department’s liaison to the digital asset industry, the Criminal Division quickly and efficiently used its expertise to immediately halt about half of this historic breach,” Duva said.
Binance and the FBI attributed the theft to TraderTraitor — the premiere North Korean hacking group responsible for stealing billions of dollars worth of cryptocurrency in multiple attacks over the last decade.
“Efforts to trace, freeze, seize, and forfeit the stolen virtual assets are ongoing, as TraderTraitor actors continue to launder such assets through various cryptocurrency bridges, mixers, and exchanges,” the Justice Department said.
Multiple blockchain security firms said North Korea and other actors are using novel, automated methods to launder the stolen cryptocurrency.
Michael Barnhart, a nation-state threat researcher at DTEX who has spent years tracking North Korean cybercrime campaigns, previously told Recorded Future News that TraderTraitor's modus operandi is to immediately offload stolen funds to Chinese money launderers for a lump sum or percentage.
Blockchain intelligence company Elliptic said this week that it saw North Korea's launderers “creating their own worthless tokens and using them to move stolen cryptoassets through decentralized exchange liquidity pools, so that no funds pass directly from the wallets holding stolen assets to the wallets that receive them.”
Elliptic noted that North Korea previously tried a similar technique last year while laundering the $1.4 billion stolen from Dubai-based crypto platform Bybit.
FBI Cyber Branch Operations Director Brett Leatherman said the North Korean regime “relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years.”
FaceStealer disruption
In addition to the Binance-related seizure, the FBI and Justice Department said they disrupted cloud infrastructure used by North Korean hackers to steal more than $400 million in cryptocurrency over the last 18 months through a social engineering campaign called “FaceStealer.”
North Korean hackers have used malicious Zoom or Teams links, pre-recorded videos and deepfakes to scam victims into downloading malware, then using the images of those victims for further attacks.
The FBI obtained a warrant to seize more than 900 webcam videos of FaceStealer victims. On a press call, FBI officials said that they have contacted many of the victims and interviewed them about the scheme but noted that they have not been able to determine who the first victim was.
An FBI agent told Recorded Future News that it is unclear if FaceStealer was one of the methods used to breach Binance.
“North Korea’s FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user” said FBI official Patrick Grandy.
“It exploits our trust in ubiquitous video conference platforms and valued personal relationships. If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough.”
According to the FBI and DOJ, the hackers lure targets with Calendly invitations to Zoom or Teams video meetings delivered from accounts stolen from prior victims. The links lead to fake domains with malware, allowing the attackers to compromise victims before they even appear in the meetings.
In multiple cases investigated by the FBI, the hackers stole cryptocurrency from the victim and hijacked accounts on platforms including Telegram, LinkedIn, Slack, and Discord — contacting the victim’s connections and proposing Zoom or Teams meetings sometimes months later.
Because the hackers have access to previous victims’ chat histories, they can craft custom messages to high-value contacts and tailor messages.
Once the target is admitted to the meeting, they play multiple videos taken of past victims to make it appear as if there are many participants. The hackers also record the target’s webcam video so that it can be used during attacks on their trusted contacts.
In some instances, the hackers used AI to create deepfake videos of prominent cryptocurrency figures. With each victim, North Korea’s compromised contact pool of targets and victims grows exponentially, according to the FBI.
“During the meeting, the hackers introduce a fake technical error into the meeting, such as claiming that the target cannot be heard, and provide a link or prompt to fix the error,” they said.
“The ‘fix’ surreptitiously installs malware on the target’s computer. With the target’s computer compromised, the hackers can steal cryptocurrency or exploit the target’s access to other computer infrastructure.”
The “fix” typically installs a browser cookie harvester, keyloggers, screen capturers, and a backdoor onto the infected device.
North Korean actors are using the scheme to target the cryptocurrency industry as well as developers working on open-source software.
The FBI said it is aware of several other attempts by North Korean hackers to target software developers, maintainers, and software libraries with significant download volume. Multiple attempts have been directed at maintainers with repositories on the JavaScript registry, Node Packet Manager (NPM), and recently against maintainers of Rust crates.
They noted that earlier this year, North Korean hackers used the FaceStealer scheme to “nearly” lure a maintainer of a “significant open-source JavaScript library into a fake Teams video chat.”
An FBI official declined to elaborate on the JavaScript maintainer incident but said it was “widely covered in the news media” and noted that the FaceStealer scheme was attributed to APT38 — a North Korean group previously accused of compromising the debug and chalk NPM packages as well as the wildly popular axios package in March.
APT38 is North Korea’s leading military hacking group responsible for the 2016 Bank of Bangladesh heist. Barnhart, DTEX’s North Korea expert, said after APT38’s success, the group was split up into several different arms, one of which is TraderTraitor.
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.