coindesk.com
The U.S. Department of Justice said it's aggressively taking control of infrastructure and assets in North Korea's leading efforts to steal billions in crypto, including technology used in the "FaceStealer" thefts and an approved seizure of $1.2 billion in the cryptocurrency recently stolen in the attack on Binance.
The authorized seizure is part of a broader effort by U.S. authorities and private companies that has frozen more than $2.7 billion of the more than $6 billion stolen from Binance on Oct. 29. The FBI attributed that attack to a North Korean military-linked hacking operation known as 'TraderTraitor.'
Read more: What is TraderTraitor, the hacking squad behind the $6.3 billion Binance heist?
Investigators are continuing to trace stolen cryptocurrency moving through blockchain bridges, mixers and exchanges, seeking to freeze and recover more of the funds, the DOJ said.
“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, principal deputy assistant attorney general for national security at the DOJ, in a statement. “Today’s announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime. The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.”
In a separate operation, federal agents seized cloud infrastructure used in a North Korean hacking campaign known as FaceStealer, which the FBI says has stolen more than $400 million in cryptocurrency over the past 18 months.
That scheme uses fake video meetings resembling Zoom or Microsoft Teams calls to trick victims into installing malware. Hackers impersonate trusted contacts using secretly recorded webcam footage from previous victims and, increasingly, AI-generated deepfake videos.
Once a target joins a fraudulent meeting, the hackers claim there is a technical problem and instruct the victim to install software or run a command to fix it. The instructions instead install malware that can steal cryptocurrency and give attackers access to other systems.
The FBI said it seized more than 900 webcam videos collected by the attackers, who have also targeted developers maintaining widely used open-source software. The agency warned that compromising a developer could allow hackers to gain access.
