by Coinstrooper Crypto Articles
Quick Take
  • The FBI is warning crypto holders about FaceStealer, a scheme North Korean hackers use to drain funds via fake video calls.
  • The bureau says it has taken more than $400 million over the last 18 months.
  • Anyone who owns crypto, works in Web3, or maintains open-source code is a potential target, the FBI adds.
  • The Justice Department ties the campaign to groups known as Sapphire Sleet, BlueNoroff, and APT38, among other names.

What Happened

The FBI is warning crypto holders about FaceStealer, a scheme North Korean hackers use to drain funds via fake video calls. The bureau says it has taken more than $400 million over the last 18 months.

Next, the North Korean hackers fake a technical error, such as claiming the target cannot be heard. The “fix” they send installs malware. In several cases, the theft came months or even more than a year after the first compromise.

The FaceStealer tactic is not new. Reports last year already tied fake Zoom meetings to $300 million in North Korean crypto theft. Google’s Mandiant team also flagged similar AI-enabled Zoom lures earlier this year.

It exploits our trust in ubiquitous video conference platforms and valued personal relationships. If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough.

Open-source developers are a growing focus. By hijacking trusted maintainer accounts, North Korean hackers could slip malicious code into widely used software, the FBI warns.

Each new FaceStealer victim also becomes a launchpad. The hackers comb contact lists, social media, and chat apps to find the next targets, the DOJ says.

Alongside the FaceStealer disruption, the DOJ moved to seize $1.2 billion from the Binance hack. Overall, North Korean hackers have stolen $7.61 billion in crypto this year, BitOK data shows.

Market Context

Anyone who owns crypto, works in Web3, or maintains open-source code is a potential target, the FBI adds.

How the FaceStealer Scheme Works

Why It Matters

The post Got a Video Call Invite From a Crypto Contact? FBI Says It Could Be North Korea appeared first on BeInCrypto.

Details

The Justice Department ties the campaign to groups known as Sapphire Sleet, BlueNoroff, and APT38, among other names. Each FaceStealer lure starts with a meeting invite sent from an account stolen from an earlier victim.

Once the target joins, the attackers secretly record the target’s webcam. Meanwhile, they play prerecorded clips of past victims the target knows, so trusted contacts appear to be on the call. The DOJ says the group also uses deepfakes of well-known crypto figures.

FBI Seizes 900 Victim Webcam Videos

The FBI says it disrupted cloud-based infrastructure behind FaceStealer and seized more than 900 webcam videos of victims. Its Los Angeles field office led the probe.