DOJ cracks down on North Korean crypto theft after $6.3 billion Binance heist

The Department of Justice on Thursday announced plans to clamp down on North Korean cryptocurrency theft following a scheme that siphoned over $6 billion from digital exchange platform Binance.The DOJ’s effort to stop North Korea from stealing crypto in order to fund its regime includes recovering billions of dollars stolen from Binance and dismantling a separate hacking operation that has targeted cryptocurrency holders and software developers.“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” Principal Deputy Assistant Attorney General for National Security M. Scott Proctor said. “Today’s announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime. The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.” The department said federal authorities have frozen more than $2.7 billion in cryptocurrency linked to the Binance theft, which occurred around Oct. 29. The DOJ also obtained court authorization to seize or restrict access to more than $1.2 billion of the stolen funds.The attack targeted Binance, one of the world’s largest cryptocurrency exchanges, and according to preliminary findings, hackers may have gained access through a compromised company computer to initiate unauthorized transfers of cryptocurrency.Investigators have attributed the theft to members of the North Korean military, part of a hacking operation the FBI calls “TraderTraitor.” Authorities are continuing to track the stolen cryptocurrency as hackers attempt to move it through digital exchanges and services that can make transactions harder to trace.Separately, the FBI announced it had seized online infrastructure used by North Korean hackers in a scheme known as “FaceStealer,” which investigators say has stolen more than $400 million in cryptocurrency over the past 18 months.The operation uses fake video meetings to trick victims into downloading malicious software that gives hackers access to their computers.According to the FBI, hackers first gain access to someone’s online account and use it to invite other people to the video meetings. During the calls, the hackers use prerecorded footage or AI-generated videos to impersonate people the victims know and trust.The hackers then create a fake technical problem and persuade victims to download software needed to fix it. Instead, the software allows hackers to steal cryptocurrency, access personal information, and take control of additional accounts.The FBI said the scheme has increasingly targeted people who develop and maintain open-source software, which is publicly available computer code that other developers can use. By compromising those accounts, hackers could spread malicious software to additional users.Federal investigators seized more than 900 webcam videos of victims as part of the investigation.COLOMBIA AND BOLIVIA ‘FAILED DEMONSTRABLY’ TO COUNTER ILLEGAL DRUG PRODUCTION“North Korea’s FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user,” Assistant Director in Charge Patrick Grandy of the FBI’s Los Angeles Field Office said. “It exploits our trust in ubiquitous video conference platforms and valued personal relationships. If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough. The FBI is sounding the alarm to elevate awareness of this growing scheme, now aimed not only at crypto theft, but also the exploitation of the open-source software supply chain.”The FBI has also launched a website with information about the scheme and guidance for possible victims.