North Korean Hackers Steal Over $400M Using AI Deepfakes and Fake Video Calls
North Korean hackers have stolen more than $400 million in cryptocurrency over the past 18 months by using AI-generated deepfakes, prerecorded video footage and social-engineering attacks, according to the U.S. Department of Justice (DOJ).
The DOJ announced Thursday that authorities had seized infrastructure connected to the operation, which the FBI calls “FaceStealer.” The campaign uses fake video conferences to trick cryptocurrency industry workers into trusting malicious contacts and installing malware.
Hackers reportedly gain access to accounts belonging to previous victims before using them to invite new targets to video meetings. During these calls, attackers play prerecorded webcam footage of trusted individuals to make it appear that the person is participating in the conversation.
The operation also uses AI-generated deepfake videos featuring recognizable figures from the cryptocurrency and related industries to make the deception more convincing.
Once the victim believes the meeting is legitimate, hackers introduce a fake technical problem, such as an issue with the audio. They then provide a link supposedly designed to fix the problem. Instead, clicking the link installs malware that gives attackers access to the victim's cryptocurrency wallets and other systems.
The hackers do not always steal funds immediately. In some cases, they reportedly wait months or even more than a year before accessing the compromised systems and moving the stolen assets.
The FBI said it recovered more than 900 webcam recordings belonging to FaceStealer victims under a federal search warrant.
The DOJ linked the campaign to several North Korean hacking groups, including Sapphire Sleet, BlueNoroff and APT38. Authorities also warned that the attackers have increasingly targeted open-source software developers, raising concerns about possible supply-chain attacks.
US Targets $1.2B in Binance Hack Funds
The announcement also included an update on the investigation into the October 29 Binance hack, which resulted in approximately $6.4 billion in stolen cryptocurrency.
The DOJ said it has obtained court authorization to seize or restrict access to more than $1.2 billion connected to the theft. This brings the total amount of funds frozen so far to more than $2.7 billion.
The FBI attributed the Binance attack to another North Korean hacking group known as TraderTraitor. Investigators said the group has been moving the stolen assets through a rapidly changing network of wallets, creating a new wallet approximately every 25 seconds.
North Korea has rejected the allegations, describing the FBI's findings as a political provocation. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, accused Washington of unfairly blaming the country for cybercrime incidents around the world.
The latest developments highlight the growing importance of cryptocurrency theft as a source of funding for North Korea. Washington has also recently sanctioned 11 individuals over a separate North Korean IT-worker operation that allegedly generated millions of dollars through cryptocurrency-related activities.
U.S. authorities continue to investigate the FaceStealer campaign and track the stolen Binance funds, with efforts to freeze and recover the assets still ongoing.