The FBI has disrupted a sophisticated cryptocurrency theft scheme orchestrated by a North Korean hacking group, which has stolen billions globally in recent years. The hackers, known by various names including Sapphire Sleet and BlueNoroff, targeted individuals in the crypto and Web3 industries, as well as open-source software developers. The FBI and Department of Justice seized over 900 webcam videos of victims, which the hackers used to impersonate and further target victims. Before the disruption, the scheme had stolen more than $400 million over an 18 months.
The hackers employed a tactic called “FaceStealer,” where they hijacked social media accounts of people known to the victim and impersonated them to initiate video calls. During these calls, they recorded victims to impersonate them later and persuaded them to download malware. The FBI stated that the hackers aimed to compromise the software supply chain, potentially impacting millions of users.
Principal Deputy Assistant Attorney General M. Scott Proctor emphasized that North Korea funds its “rogue regime and illicit weapons program through cryptocurrency theft.” FBI Cyber Branch Operations Director Brett Leatherman noted that the regime relies on proceeds from large-scale cryptocurrency theft to support its illicit activities. Additionally, members of the North Korean military, referred to as “TraderTraitor,” stole over $6 billion in cryptocurrency from Binance on October 29.
Federal authorities have worked with private companies to recover stolen funds, freezing over $2.7 million and obtaining court approval to seize or restrict access to $1.2 billion of the stolen amount. The FBI issued a flash alert to inform the public about the FaceStealer campaign, and efforts to trace, freeze, seize, and forfeit the stolen virtual assets are ongoing.