WASHINGTON — U.S. authorities have seized or restrained more than $1.2 billion in cryptocurrency stolen from the exchange Binance last month, and have taken down servers used in a separate video-call scam that stole more than $400 million, the Justice Department said Thursday, Nov. 12. The department blames both on hackers working for North Korea, which has denied the Binance accusation.
Related: Vanderbilt Restores Systems After Cyberattack as BYOD Gang Claims 1 Million SSNs.
The Binance money
More than $6 billion was taken from Binance on or around Oct. 29, the FBI said. The bureau attributes the theft to North Korean military hackers it calls TraderTraitor. The Associated Press put the loss at about $6.3 billion and called it the largest crypto theft on record, DW reported. Pyongyang has denied involvement, the BBC reported.
U.S. agencies and private companies have frozen more than $2.7 billion of the stolen funds so far, and the court-approved seizure covers more than $1.2 billion of it.[1][2] The department said the hackers are still moving the rest through various cryptocurrency channels.[1]
Seized funds do not return to victims automatically. Authorities usually file a forfeiture claim, and a judge decides who has a rightful claim.[2]
How the video-call scam works
The FBI calls the second scheme FaceStealer and ties it to a different North Korean group, known as Sapphire Sleet or UNC1069.[2]
The department described the method this way. Hackers send meeting invitations from accounts taken over from earlier victims, using imitation versions of Zoom, Microsoft Teams and Google Meet. Once the target joins, they play a recorded clip of someone the target knows while the audio appears to fail. A pop-up then offers a link to fix the sound, and that link installs malware.[2][3]
In some cases the hackers waited months, or more than a year, before taking funds. They also recorded each victim’s webcam to use against that person’s contacts.[2]
The FBI said it seized more than 900 victim videos under a federal warrant.[2] The bureau said hackers are also beginning to use AI-generated deepfakes of well-known crypto figures.[2]
Who is targeted
Most targets work in cryptocurrency and web3, and the hackers are increasingly going after open-source software developers.[2][3]
Patrick Grandy, who leads the FBI’s Los Angeles field office, said anyone who cannot imagine falling for it is “not thinking creatively enough,” CNBC reported.
What happens next
The Justice Department said efforts to trace and freeze the remaining Binance funds continue.[1] More coverage is on our Technology page and the Economic Warfare Dashboard.
Sources
- CNBC: U.S. seizes $1.2 billion in cryptocurrency stolen from Binance
- DW: US disrupts North Korea’s $400 million crypto scam, FBI says
- BBC News: North Korean hackers used fake video calls in $400m crypto hack, says FBI
Read next in Crime & Law
Most read this week
- U.S. Envoys Witkoff and Kushner Hold Talks With Putin in Moscow, Then Head to Dublin to Brief Zelensky
- Israeli Strike on Gaza’s Nasser Hospital Kills Six, Including a Surgeon, Health Ministry Says
- Kremlin Names Abu Dhabi Team as Ukraine Sets Security and Prisoner Priorities
- Drones Kill Workers at Zaporizhzhia Nuclear and Thermal Plants, IAEA Says, as Russian Strikes Hit 5 Substations
- Nvidia Board Hires Wachtell’s Joon Kim to Lead Huang Probe as Shares Fall 5.47% and an Investor Sues
Latest
- Mossad Chief Gofman Is in Washington for Iran War Talks With CIA Director, Jerusalem Post Reports
- Iran News Update, Nov. 13: Radar Claim Disputed, Nuclear Watchdog Presses Tehran, Trump Says No Deal Needed
- Six Killed as Unfinished Eight-Story Building Collapses Near Nairobi
- EU Leaders Meet in Dublin for the Bloc’s First Summit on Artificial Intelligence
- Storm Charles Floods Portugal and Spain, Cancels Hundreds of Flights and Moves on Italy
Get The Boston Report Briefing
Our free weekly email with the most important stories from Boston and the world. Unsubscribe anytime.
Free. We never sell your address. Privacy policy