North Korea Steals $400M in Crypto Using AI and Deepfakes, DOJ Says

North Korean hackers have stolen more than $400 million in cryptocurrency over the past 18 months by deploying a social-engineering tactic that incorporates secretly recorded footage and artificial intelligence deepfakes, according to the U.S. Justice Department. Officials announced this finding on Thursday alongside the seizure of the underlying infrastructure used in the operation, bringing fresh attention to global concerns often discussed in connection with broader updates regarding North Korea news.

The Federal Bureau of Investigation refers to the operation as the "FaceStealer" scheme, which weaponizes video conference calls. Hackers reportedly draw targets into meetings by utilizing accounts compromised from previous victims, then play prerecorded webcam recordings of trusted contacts to mimic their presence and build trust. Additionally, the perpetrators generate deepfake videos depicting well-known figures within the cryptocurrency and related sectors to enhance the credibility of the ruse.

Once a target feels secure, the attackers simulate a technical problem, such as claiming audio is failing, and provide a link intended to resolve the issue. Instead, the link installs malware on the target's device. This allows hackers to drain crypto wallets or leverage the victim's access to additional systems, sometimes waiting months before executing their attacks. A federal warrant enabled the FBI to seize more than 900 webcam recordings belonging to victims of the FaceStealer operation.

North Korean hackers stole $400 million in crypto using AI deepfakes and prerecorded video calls.

The Department of Justice linked this campaign to multiple North Korean hacking groups, including Sapphire Sleet, BlueNoroff, and APT38. Authorities warned that these threat actors have increasingly targeted open-source software developers to facilitate potential supply-chain attacks. North Korea has denied involvement in these activities, characterizing the allegations as political provocations.

Seizure of Binance Hack Funds

Simultaneously, the department provided an update concerning a record-breaking cyberattack on the Binance exchange that occurred on October 29. Officials stated they have secured court authorization to restrain or seize more than $1.2 billion out of roughly $6.4 billion stolen during the incident, contributing to a total of over $2.7 billion frozen thus far. The FBI attributed this specific theft to a North Korean group named TraderTraitor, noting that the regime has rapidly laundered proceeds by generating a new wallet approximately every 25 seconds.

These enforcement actions highlight the vital role that cryptocurrency theft plays in funding the Pyongyang regime. Recently, the United States sanctioned eleven individuals linked to a North Korean information technology worker scheme that moved millions in digital assets. Investigations and recovery efforts regarding the stolen Binance funds remain active as authorities continue tracing illicit transactions.

Why it matters

The escalation of sophisticated cryptocurrency thefts by state-backed groups demonstrates the evolving threat landscape facing digital asset firms, developers, and financial institutions globally. As hackers adopt advanced artificial intelligence tools like deepfakes and prerecorded video feeds to bypass human verification, organizations and workers must adopt more rigorous authentication standards during remote communications. These developments impact security protocols across the international financial sector.