The United States Department of Justice, alongside the FBI, has seized server infrastructure and domains belonging to FaceStealer, a North Korean cybercrime syndicate. Over the past 18 months, the group looted more than $400 million in crypto assets from workers and entities across the digital asset industry.
The loss of hundreds of millions of dollars began with seemingly convincing visual contact on a computer screen. According to federal court search documents, investigators seized more than 900 victim webcam recordings previously controlled by the syndicate.
How Deepfakes Breached Victims’ Defenses
The hackers’ tactics began with video conference calls. Attackers contacted targets using stolen accounts from previous victims to avoid raising suspicion. Once the call connected, perpetrators did not show their real faces, instead streaming pre-recorded webcam footage of individuals already trusted by the victims. In other scenarios, hackers leveraged artificial intelligence to display deepfakes of prominent crypto industry figures.
Once targets felt safe speaking with a familiar face, the attackers launched their technical ruse. They feigned technical difficulties, such as inaudible audio. To resolve the issue, perpetrators provided fraudulent troubleshooting links. Victims who clicked the links inadvertently installed malware directly onto their devices.
Prolonged Infiltration Before the Breach
The deployed malicious software operated in two distinct ways depending on the target. On personal wallets, the malware could drain balances instantly. When targeting corporations, however, attackers exercised restraint. The malware was left dormant to quietly infiltrate corporate internal networks for months, sometimes exceeding a year, before the breach was executed.
The US Department of Justice linked FaceStealer’s operations to several Pyongyang hacking units, including Sapphire Sleet, BlueNoroff, and APT38. These groups have aggressively targeted open-source developers, aiming to trigger supply-chain attacks by injecting malicious code into shared projects used across developer ecosystems.
Asset Hunt and Communication Vigilance
The seizure of FaceStealer domains coincided with other enforcement actions by US authorities. On a separate track, law enforcement is tracking and moving to seize $1.2 billion in crypto assets stolen by the TraderTraitor group from the breach of crypto exchange Binance.
For developers and workers across the web3 sector, the case makes clear that identity verification is no longer as simple as seeing a colleague’s face on camera. Checking link authenticity before clicking remains the safest defense, even when the person on the other end of the call appears familiar.
Reported by Decrypt.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
