The U.S. government has dismantled a North Korean cyber operation called FaceStealer, which stole over $400 million in cryptocurrency. The campaign, active for 18 months, used sophisticated social engineering tactics, including deepfakes and fake technical fixes, to target cryptocurrency professionals, Web3 developers, and open-source contributors.
According to the FBI, hackers hijacked accounts on platforms like Telegram, LinkedIn, Slack, and Discord to lure victims into video meetings. During these calls, they secretly recorded webcam footage of targets, which was later used to manipulate other victims. The attackers then displayed fake error messages to trick users into installing malware that stole crypto data and account credentials.
The FBI identified more than 900 recorded webcam videos of tech workers, highlighting the scale of the deception. Researchers at ArticWolf linked the campaign to the BlueNoroff hacker group, noting additional lures such as fake financial documents and security audits. The group targeted 677 individuals across 58 countries, focusing on company founders and senior executives.
In a separate development, the U.S. Justice Department announced the freezing of over $2.7 billion from the $6.4 billion Binance crypto heist, with court authorization to seize or restrain more than $1.2 billion of that amount.