Federal Agencies Disrupt North Korean Crypto Heist Ring

The Federal Bureau of Investigation and the Department of Justice disrupted a North Korean hacking operation that stole more than $400 million over 18 months. Federal officials announced the takedown on Thursday. The action targeted a cloud-based infrastructure used by the group to orchestrate its thefts.

The disruption resulted in the seizure of more than 900 webcam videos of victims. These victims worked in the cryptocurrency and Web3 industries worldwide. Web3 applications interact with blockchain ledgers that store digital data.

Principal Deputy Assistant Attorney General for National Security M. Scott Proctor stated that the North Korean government funds its regime and weapons program through such theft. He noted that the stolen cryptocurrency supports illicit operations.

The FBI attributed the activity to a hacking group known by several names in the private sector. These designations include Sapphire Sleet, UNC1069, Stardust Chollima, APT38, and BlueNoroff.

Bill Essayli, the federal prosecutor for Los Angeles, said the seizure demonstrates America’s fight against rogue states. He described cryptocurrency as fertile ground for North Korea to defraud victims and fund its activities.

The hackers used a social engineering campaign called FaceStealer to target victims. They focused on people in the crypto industry and those who maintain open-source software.

The scheme involved hijacking accounts on LinkedIn, Telegram, Slack, and Discord. The attackers impersonated trusted contacts to lure victims into video calls on Zoom, Microsoft Teams, or Google Meet.

While victims waited for calls to begin, hackers secretly recorded them. These videos were used to impersonate victims and target others later. Once calls started, attackers convinced victims to install malware while resolving technical issues.

FBI Cyber Branch Operations Director Brett Leatherman said the regime relies on these proceeds to fund weapons programs. The group stole billions of dollars in recent years. The FBI stated the objective is to compromise the software supply chain by infiltrating trusted developers.

Separate from the FaceStealer campaign, North Korean military members stole more than $6 billion from the Binance exchange on Oct. 29. Federal authorities named this group TraderTraitor. Binance replaced the stolen assets for customers but has not recovered the loot. Authorities froze $2.7 million and seized $1.2 billion of the funds.