U.S. Department of Justice: North Korean hackers use deepfake video calls to steal over $400 million in cryptocurrency assets

The U.S. Department of Justice stated on Thursday that North Korean hackers have stolen over $400 million in cryptocurrency assets through a social engineering scheme based on secretly recorded videos and AI deepfakes over the past 18 months, and announced that it has seized the infrastructure supporting this operation. The FBI refers to this method as "FaceStealer," which centers on turning video conference calls into traps: hackers lure targets into meetings using previously stolen accounts from victims, then play pre-recorded footage of trusted contacts to simulate their presence, thereby gaining the target's trust.

The group also uses AI to generate deepfake videos of well-known figures in the cryptocurrency and related industries, making the scams more convincing. Once the target lowers their guard, the attackers create false technical issues, such as claiming the other party cannot hear them, and provide a so-called "fix" link that is actually used to implant malware. Afterward, hackers can empty the victim's wallet or exploit their system permissions, sometimes lying in wait for months or even over a year before taking action. The FBI stated that it has seized over 900 segments of camera footage from FaceStealer victims based on federal search warrants.

The Department of Justice linked this operation to North Korean-related groups such as Sapphire Sleet, BlueNoroff, and APT38, warning that these hackers are increasingly targeting open-source software developers, seemingly paving the way for supply chain attacks. On the same day, the Department of Justice also reported progress in the Binance theft case, stating that it has obtained court authorization to seize or restrict over $1.2 billion of the approximately $6.4 billion in stolen assets, which is part of the over $2.7 billion that has already been frozen. The FBI attributes this theft to the North Korean group TraderTraitor and claims it is laundering money at a rate of creating a new wallet approximately every 25 seconds. North Korea denies involvement, stating that the FBI's conclusions are a political provocation.