US DOJ seizes $1.2B tied to Binance theft and disrupts North Korean FaceStealer deepfake social engineering campaign
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 13/11/2026 00:00; os links antigos trazem para cá.
The US Department of Justice announced coordinated actions against North Korean hacking groups on 13 November 2026. They include the seizure of cloud infrastructure behind the FaceStealer social engineering scheme and the court-authorized seizure of more than $1.2 billion in assets stolen from Binance (cyberscoop.com, securityonline.info). The FBI attributes the theft of more than $6 billion in virtual assets from Binance to the North Korean military hacking unit TraderTraitor, and has frozen about $2.7 billion of the stolen funds (cyberscoop.com). FaceStealer has run for about 18 months and has drained more than $400 million from the cryptocurrency and Web3 sectors (cyberscoop.com, securityonline.info). The actions aim to cut off illicit revenue that funds North Korea's weapons programs (securityonline.info). An FBI alert accompanies the seizures, and the sources say it lists wallet addresses for blocking.
Detalhes técnicos
- FaceStealer relies on impersonation through fake Zoom and Microsoft Teams interfaces to hijack accounts on Telegram, LinkedIn, Slack and Discord (cyberscoop.com).
- Attackers exploit victims using a library of more than 900 secretly recorded webcam videos (cyberscoop.com). The campaign is described as a deepfake scheme built on hijacked video calls (securityonline.info).
- Targets include Web3 workers and open-source developers, who are tricked into installing malware that steals cryptocurrency and hijacks communication apps (securityonline.info).
- Victims are lured into running troubleshooting scripts sent during video calls (securityonline.info).
Remediação
- Do not run troubleshooting scripts sent during video calls (securityonline.info).
- Victims and platforms should block the wallet addresses listed in the FBI alerts (securityonline.info).
- Treat unexpected meeting links and call interfaces with caution, since fake Zoom and Teams pages are used to take over accounts (cyberscoop.com).
Relatos divergentes
- Attribution of FaceStealer: securityonline.info attributes the campaign to North Korean APT38. cyberscoop.com attributes the Binance theft to TraderTraitor and does not name a group for FaceStealer in the text provided. The APT38 link for FaceStealer rests on a single source and is not corroborated by the other.
- Frozen funds: only cyberscoop.com reports the roughly $2.7 billion frozen. securityonline.info does not mention it.
Linha do tempo
-
US DOJ disrupts North Korean FaceStealer deepfake crypto theft and seizes $1.2B from Binance hack
ler a análise desta fonte ocultar
The US Department of Justice conducted coordinated operations to dismantle the North Korea FaceStealer scheme and to seize substantial digital assets linked to a recent Binance exchange breach. FaceStealer, a deepfake social engineering campaign attributed to North Korean APT38, exploited hijacked video calls over 18 months to trick Web3 workers and open-source developers into installing malware that stole over $400 million in cryptocurrency and hijacked communication apps. In parallel, authorities seized $1.2 billion from stolen assets tied to a $6 billion breach of Binance, attributed to North Korea's TraderTraitor military unit. These disruptive actions aim to cut off illicit cryptocurrency revenue streams that fund North Korea’s weapons programs. Victims and platforms are urged to avoid running troubleshooting scripts sent during video calls and to block wallet addresses listed in FBI alerts.
-
US seizes North Korean hacking infrastructure and $1.2 billion in Binance theft linked to FaceStealer social engineering
ler a análise desta fonte ocultar
The US Justice Department announced coordinated actions against North Korean hacking groups responsible for stealing billions in cryptocurrency, including the seizure of cloud infrastructure behind the FaceStealer social engineering scheme and the court-authorized seizure of over $1.2 billion stolen from Binance. The FBI attributes the theft of more than $6 billion in virtual assets from Binance to the North Korean military hacking group TraderTraitor and has frozen about $2.7 billion of the stolen funds. The FaceStealer campaign uses sophisticated impersonation via fake Zoom and Microsoft Teams interfaces to hijack accounts on platforms like Telegram, LinkedIn, Slack, and Discord, exploiting victims through a library of over 900 secretly recorded webcam videos. This ongoing campaign has drained over $400 million from cryptocurrency and Web3 sectors in the past 18 months. The FBI alert and seizure highlight the complexity and scale of North Korea's evolving tactics in cryptocurrency theft and cybercrime funding.