DOJ takes aim at $1.2B in Binance loot as FBI disrupts North Korean scam
The US has seized servers linked to a North Korean scam that used fake video meetings and deepfakes to steal more than $400 million in crypto, and has moved to seize $1.2 billion that was taken from Binance.
Key points
- “North Korean hackers are increasingly blending cyber intrusion, social engineering, and emerging technologies such as deep fakes to make their impersonation efforts more convincing and scalable.” Binance heist update The FBI also provided an update on its efforts to recover the stolen assets from the October 29 attack on Binance.
- The FBI attributes FaceStealer to a North Korea-linked group tracked as Sapphire Sleet, which is widely regarded as a Lazarus Group offshoot.
- “You're going to think it's real because it's going to be based on either conversations or interests you've expressed in the past with this actual person,” said special agent Jeremy Robertson, who oversees counterintelligence and cyber investigations at FBI Los Angeles.
The US government on Thursday said it had obtained court authorization to seize or restrain use of over $1.2 billion stolen during last month's $6.3 billion Binance heist, as part of a larger effort to disrupt North Korea's ongoing cryptocurrency theft.
Additional details
- Clicking to access the “fix” installs cryptocurrency-stealing malware on the victim’s computer and sends their contact list to the digital thieves to perpetuate the scam.
- The agency previously blamed the $6.3 billion heist on TraderTraitor, a North Korean hacking operation also linked to Lazarus Group.
- 900+ faces stolen The FBI said it had seized more than 900 webcam videos belonging to these tech workers.
- Victims are typically people working in the cryptocurrency and web3 industries, along with open source software developers and maintainers who DPRK hackers target in the hope of accessing the software repositories they control as the first step towards creating supply chain attacks.
- The URL directs the victim to a fake Zoom or Teams meeting, and the cybercriminals record the target’s webcam video while playing a phony, prerecorded video of the person who purportedly sent the meeting invite.
How this summary was made: extractive summary — built from the sources' own reporting. It is drawn only from the reporting of the sources listed below — read the originals for full detail. How we summarize →
Advertisement
Every article behind this summary — 2 articles from 2 outlets
Get stories like this in your inbox.
Subscribe — it's freeOne free email at 6am — your topics, deduplicated, five minutes. No account, no paywall.