North Korean Hackers Steal $400 Million in Cryptocurrency

North Korean hackers have stolen over $400 million in cryptocurrency, as disclosed by the FBI. The attack involves impersonating friends and colleagues during fake video calls. The hackers hijack messaging accounts, record webcam footage, and trick contacts into downloading malware.

The scheme, called “FaceStealer,” is known for its complex execution, with hackers creating fake video conferencing platforms like Zoom and Microsoft Teams. The FBI has captured computer infrastructure tied to the scam and found more than 900 webcam recordings used in the operation.

How FaceStealer Operates

Stage 1: Compromising the First Victim

The hackers start by targeting a compromised computer. They search for cryptocurrency details, access contacts, and record the victim’s webcam during video calls.

Stage 2: Hijacking Messaging Accounts

The attackers take over accounts on platforms such as Telegram and LinkedIn. They pose as the account owner to arrange video calls under the guise of catching up or discussing investments.

Stage 3: Setting Up Fake Video Calls

The hackers may use legitimate scheduling services. Links sent to join calls redirect to fake conferencing sites under their control.

Stage 4: Playing Secretly Recorded Footage

Victims see recordings of individuals they know, previously captured by the hackers. They may show several clips to simulate a group meeting.

Stage 5: Installing Malware

The hackers simulate technical issues and instruct victims to download updates or run code, installing malware that collects personal information and records their webcam.

Stage 6: Repeating the Attack

With each new victim, the cycle continues. Hackers may delay theft to allow wallet balances to increase. In some cases, they used deepfake videos to impersonate cryptocurrency figures.

FBI Actions

The Justice Department seized cloud infrastructure used in FaceStealer, linked to North Korean groups like Sapphire Sleet. The scheme is believed to fund North Korea’s weapons program.

Identifying Potential Targeting

The FBI advises caution with unexpected video invites, warning against installing software during calls. Use authorized apps and verify invitations separately. Keep webcams off until the call begins properly.

If compromised, secure your accounts, change passwords, and notify contacts. Move cryptocurrency to new wallets on unexposed devices. Report incidents to the FBI at IC3.gov, with “FaceStealer” as a keyword.