US Seizes North Korean Hacking Infrastructure, Recovers $1.2 Billion in Binance Crypto Theft
The U.S. Department of Justice announced actions against North Korean hacking groups, seizing infrastructure used in social engineering schemes and over $1.2 billion in cryptocurrency stolen from Binance.
The U.S. Department of Justice has announced a significant crackdown on North Korean cybercriminal operations, including the seizure of cloud infrastructure used in the "FaceStealer" social engineering scheme and the court-authorized seizure of over $1.2 billion in cryptocurrency stolen from the Binance exchange. This action is part of a broader effort to disrupt the financial activities of North Korean military hackers, who have been implicated in a series of large-scale cryptocurrency heists.
The FBI attributes the Binance theft, which totals over $6 billion in virtual assets, to a North Korean hacking group known as TraderTraitor. While investigators and private virtual asset service providers have managed to freeze more than $2.7 billion of the stolen funds, the DOJ's seizure represents a substantial portion of the recovered assets, halting approximately half of this "historic breach," according to A. Tysen Duva, assistant attorney general in charge of the DOJ’s Criminal Division.
The FBI also issued a detailed alert outlining the sophisticated tactics employed by these hackers. They reportedly hijack accounts on popular platforms like Telegram, LinkedIn, Slack, and Discord to invite targets to fake video conferences. These invitations lead to typo-squatted domains hosting imposter versions of legitimate video conferencing tools such as Zoom and Microsoft Teams, designed to be indistinguishable from the real interfaces.
A particularly alarming aspect of the scheme is the hackers' use of over 900 secretly recorded webcam videos. These videos, captured from victims as they waited for their video chats to begin, were then played back by the hackers to impersonate victims in subsequent attacks. This tactic, combined with the acquisition of each victim's contact lists, allows the pool of targets and victims to grow exponentially, the FBI warned.
Beyond direct cryptocurrency theft, this campaign has also targeted the broader Web3 and cryptocurrency sectors, draining over $400 million in the past 18 months. The operation's reach extended to a supply-chain attack earlier this year, where hackers lured the maintainer of a significant open-source JavaScript library into a fake Teams meeting. This allowed them to inject malicious dependencies that could have been downloaded by unsuspecting users alongside legitimate software.
North Korea has a well-documented history of using cryptocurrency heists to fund its regime, often in conjunction with efforts to employ remote IT workers at U.S. businesses to launder illicit funds and evade international sanctions. Experts note a significant evolution in both the scale and sophistication of these North Korean schemes, with the core goal remaining the exploitation of trust to compromise targets.
"Cryptocurrency unfortunately has become fertile ground for North Korea to defraud victims and fund its malign activities," stated Bill Essayli, a U.S. attorney for the Central District of California. "Today’s seizure shows that America will continue the fight against rogue states who financially gain from cybercrime." The FBI acknowledged the crucial assistance provided by cybersecurity firms Arctic Wolf, Jumpsec, and Microsoft Threat Intelligence Center in this investigation and seizure.