The FBI uncovers a new North Korean hacking operation following the theft of more than $400 million through video call scams

The FBI reported Thursday that several hackers linked to North Korea have stolen more than $400 million in cryptocurrency over the past 18 months using a sophisticated social engineering technique called "FaceStealer." "Over the past 18 months, this scheme has resulted in the theft of more than $400 million," the FBI stated on its official X account.

The agency also announced that it had dismantled part of the cloud infrastructure used by the criminals and that it had identified and seized more than 900 webcam videos belonging to victims from around the world. Similarly, the FBI noted that the perpetrators use fraudulent versions of video conferencing platforms and covert webcam recordings to deceive workers in the cryptocurrency sector. Once they gain access to their victims' devices, they carry out cyber intrusions to steal their digital assets.

U.S. authorities attributed the operation to a North Korean hacking group known as "Sapphire Sleet" or UNC1069, which, according to several reports, is not part of the other North Korean hacker groups accused of the massive theft of $6.3 billion from the cryptocurrency platform Binance. This theft forced the company to suspend deposits and withdrawals temporarily.

Economy

Binance says it has recovered 90% of funds stolen in largest crypto hack in history

Joaquín Núñez

Shortly after this operation, both the FBI and the blockchain technology and intelligence analytics firm TMR Labs determined that the TraderTraitor group, linked to North Korea, was primarily responsible for the cyberattack against Binance, resulting in the largest theft of its kind on record to date. TMR Labs also noted that several elements of the attack match patterns observed in previous operations attributed to North Korean hackers, such as the infamous $1.5 billion theft suffered last year by the cryptocurrency exchange Bybit.