Justice Department disrupts North Korean cryptocurrency schemes, restrains more than $1.2 billion

The Justice Department on Thursday announced actions to disrupt North Korean cryptocurrency theft, including seizing infrastructure used in a deepfake scheme and restraining or seizing more than $1.2 billion stolen from the Binance exchange.

The department said the North Korean government uses large-scale cryptocurrency theft to fund its regime and illicit weapons program.

According to the U.S. Attorney’s Office for the Central District of California, the department disrupted cloud-based infrastructure used in a social engineering scheme the FBI calls “FaceStealer.” In the scheme, hackers lured victims into video meetings using accounts stolen from prior victims. The hackers played pre-recorded video or artificial deepfakes of trusted contacts or influential people in the cryptocurrency industry to gain the target’s trust.

The hackers then introduced a fake technical error, providing a link to a “fix” that installed malware on the target’s computer. The compromised computer allowed the hackers to steal cryptocurrency or access other infrastructure. The scheme resulted in the theft of more than $400 million during the past 18 months, according to the department.

The operation targeted individuals in the cryptocurrency and web3 sectors, as well as those involved in open-source software development, attempting to gain access to enable software supply-chain attacks. The FBI seized more than 900 webcam videos of victims pursuant to a federal warrant.

Separately, the department said members of the North Korean military, referred to by the FBI as “TraderTraitor,” stole more than $6 billion from Binance on or about Oct. 29. The Justice Department, working with law enforcement partners and virtual asset service providers, has frozen more than $2.7 billion of those assets. The department has obtained court authorization to seize or restrain more than $1.2 billion of that amount.

The FBI issued an alert last week urging virtual asset providers to block transactions from addresses the actors are using to launder the stolen assets.