FBI Moves to Seize $1.2 Billion Stolen From Binance and Disrupts ‘FaceStealer,’ a Fake Video-Call Scheme Blamed for $400 Million in Thefts: Your Questions Answered
The Justice Department has court approval to seize or restrain more than $1.2 billion from last month’s Binance theft. The FBI also disrupted infrastructure behind FaceStealer, a North Korean scheme that uses fake Zoom and Teams meetings and hijacked contacts to install malware.
U.S. authorities announced two actions this week against North Korean hackers. One recovers a share of the largest cryptocurrency theft on record. The other disrupts a social engineering scheme built around ordinary business video calls. The second will matter more to most companies.
The answers below are based on reporting by The Record from Recorded Future News, with additional detail from SecurityWeek.
What exactly did the government seize?
The Justice Department obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance last month. The theft totaled about $6.3 billion. Cryptocurrency platforms and the government have frozen more than $2.7 billion of it so far, and the $1.2 billion comes out of that frozen amount. SecurityWeek notes that in cases like this, the government typically files a forfeiture claim and a judge decides who is entitled to the recovered funds.
Who is blamed for the Binance theft?
Binance and the FBI attribute it to TraderTraitor, a North Korean hacking group behind several large cryptocurrency thefts. The Justice Department says efforts to trace and recover more of the money are continuing, because the hackers are still laundering it through bridges, mixers and exchanges.
What is FaceStealer?
It is a separate North Korean social engineering scheme. The FBI says it has led to the theft of more than $400 million in cryptocurrency over the past 18 months. U.S. officials say they disrupted cloud infrastructure used to run it, and the FBI obtained a warrant to seize more than 900 webcam videos of victims. The FBI attributes the scheme to APT38, a North Korean military hacking group. An FBI agent told The Record it is unclear whether FaceStealer played any part in the Binance breach.
How does the scam work?
- A trusted contact reaches out. The invitation, often a Calendly link to a Zoom or Teams meeting, comes from a real account the hackers stole from an earlier victim, sometimes on Telegram, LinkedIn, Slack or Discord. Because they can read past chat history, the messages can be tailored, and they sometimes arrive months after the original compromise.
- The meeting link is fake. It leads to a lookalike domain that carries malware, so the target can be compromised before the call even starts.
- The “meeting” is staged. The hackers play recorded videos of earlier victims so the call seems to have several participants. In some cases they used AI deepfakes of well-known cryptocurrency figures.
- A fake glitch sets the trap. Someone claims the target cannot be heard and offers a link or prompt to “fix” it. That fix installs malware, typically a browser cookie stealer, keyloggers, screen capture tools and a backdoor.
- The victim becomes the next lure. The target’s own webcam footage is recorded and used against their contacts, which is why the FBI says the pool of victims grows so fast.
Who is being targeted?
Mainly the cryptocurrency industry and software developers, especially maintainers of widely used open-source packages on npm and, more recently, Rust crates. The FBI says FaceStealer was used earlier this year in a near miss against the maintainer of a significant JavaScript library. An FBI official warned that even very experienced, security-conscious users can be fooled.
What this means for your company
You do not need to hold cryptocurrency to be a target. The tricks here, a familiar contact, a normal-looking meeting invite and a “your audio isn’t working” fix, would work in any office. Practical steps:
- Make it a rule that nobody installs software, plugins or “audio fixes” prompted from inside a meeting or chat. Real fixes come through your IT team or the app’s normal settings.
- Join video calls from the installed app or a calendar entry you created, not from links that lead to unfamiliar domains.
- When a known contact sends an unexpected meeting request, especially about money, access or code, confirm it through a separate channel you already trust.
- Protect the accounts that make you a convincing lure: turn on multi-factor authentication for messaging, social and collaboration platforms, and review connected sessions regularly.
- Limit who can install software on company computers, and use endpoint monitoring that flags new keyloggers, screen capture tools and stolen browser sessions.
- If your developers publish or maintain code, give them extra protection, since their accounts can open a path into many other organizations.
Want your team to be able to spot a staged meeting before anyone clicks the “fix”? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
