FBI Disrupts North Korean Cyber Scheme Targeting Crypto and Software Developers

The Federal Bureau of Investigation (FBI) and U.S. Department of Justice (DOJ) announced coordinated actions against North Korean-linked cyber operations involving cryptocurrency theft, social engineering and attempts to compromise software development. One campaign, known as FaceStealer, reportedly generated more than $400 million in stolen cryptocurrency over the past 18 months. Authorities seized cloud infrastructure associated with the operation and more than 900 webcam videos that attackers had collected and used to impersonate victims in follow-on approaches. The action reflects federal operational focus on disrupting adversary infrastructure and limiting the reuse of stolen identities and access.

FaceStealer relied on familiar business communications to persuade targets to install malware. Attackers reportedly hijacked genuine accounts on services including Telegram, LinkedIn, Slack and Discord, then used prior conversations to make invitations appear credible. A link led to an imitation of a Zoom or Microsoft Teams meeting, where a recording of a familiar contact played. The target was prompted to fix an apparent audio problem, sometimes by running a script or pasting commands into a computer terminal. Instead, those steps installed malware capable of recording keystrokes, capturing screens and maintaining attacker access. The process also recorded new victims, expanding the pool of material available for future impersonation attempts.

The threat extended beyond individual cryptocurrency holders to software supply chains. The FBI said attackers compromised the computer of a developer maintaining widely used software and used that access to introduce malicious code. The attempted compromise was detected and stopped before it spread widely. A related account in the source material describes an open-source JavaScript library maintainer being lured into a fake Teams meeting, after which attackers created malicious dependencies that could have been distributed alongside legitimate software. For federal contractors and technology suppliers, this illustrates how access to a trusted developer, maintainer or release workflow can create downstream risk for customers and users—even when the initial target is not a government system.

Separately, DOJ obtained court authorization to seize or restrain more than $1.2 billion stolen from Binance. This amount is included in—not additional to—the more than $2.7 billion in stolen assets frozen through public- and private-sector efforts. The Binance theft was reported at roughly $6.3 billion, and the FBI attributed it to North Korean military hackers it calls TraderTraitor; officials said the Binance operation and FaceStealer likely involved different North Korean actors. These actions underscore government demand for cyber investigations, threat intelligence, digital forensics, identity and access security, software supply-chain protection, and cryptocurrency tracing and recovery. They do not, however, identify a solicitation, contract value, award or procurement contact. Contractors with relevant capabilities can use the developments to assess mission fit and review their own identity, developer-access and incident-response controls.

• FaceStealer used recorded video calls and impersonation through compromised accounts to distribute malware and steal cryptocurrency.
• The FBI reported more than $400 million in cryptocurrency theft associated with the campaign over 18 months.
• Authorities seized the campaign’s cloud infrastructure and a library of more than 900 secretly recorded victim webcam videos.
• Attackers reportedly used accounts on Telegram, LinkedIn, Slack and Discord and imitation Zoom or Microsoft Teams meeting pages.
• Malware instructions disguised as audio troubleshooting could involve running a script or entering commands in a computer terminal.
• The FBI said a compromised software developer’s access was used to add malicious code; the attempted attack was stopped before it widely spread.
• DOJ received court authorization to seize or restrain more than $1.2 billion stolen from Binance; that sum is part of the more than $2.7 billion frozen through public- and private-sector work.
• The reported Binance theft was roughly $6.3 billion; the source says the Binance and FaceStealer activity likely involved different North Korean actors.
• Arctic Wolf executive Justin Moore said investigators had identified “more than 677 targets across 58 countries” and described an expanding playbook involving document-sharing platforms, identity verification requests and other trusted workflows.
• No solicitation, contract award, procurement value or point of contact was identified; firms can review opportunities in cyber investigations, threat intelligence, identity security, software supply-chain defense and cryptocurrency tracing.