US Authorities Detail $400 Million Cryptocurrency Scheme Linked to North Korea

United States law enforcement agencies have issued a warning regarding a cyber theft campaign attributed to North Korean state-sponsored actors, who reportedly stole more than $400 million in cryptocurrency over the past 18 months. According to the Federal Bureau of Investigation (FBI) and the US Department of Justice, the operation, designated by investigators as FaceStealer, has compromised more than 900 victims. The targets consist primarily of workers and developers within the web3 and cryptocurrency sectors.

Investigators stated that the scheme specifically focuses on individuals involved in maintaining open-source software. To execute the attacks, perpetrators utilize fraudulent or compromised social media profiles to invite targets to virtual meetings. These calls are hosted on counterfeit versions of popular communication services, including Zoom, Microsoft Teams, and Google Meet.

During the calls, attackers play pre-recorded video footage of individuals known to the victim to simulate a legitimate interaction. The hackers then use simulated audio malfunctions to induce the target into taking actions that expose private keys and digital assets.

FBI Cyber Director Brett Leatherman stated that North Korea relies on proceeds from cryptocurrency theft to fund its weapons programs, adding that billions of dollars have been stolen in recent years. The statement forms part of a broader alert issued to the financial and technology sectors regarding state-backed cyber threats.

The findings follow a separate incident reported by the cryptocurrency exchange Binance, which was recently targeted in a breach involving an estimated $6.3 billion. US agencies attributed that attack to North Korea-linked actors, while authorities in Pyongyang denied involvement in the theft.

Written by Sandy van Dongen sandy.vandongen@alpineweekly.com