North Korea Stole $400 Million in Crypto Using Deepfake

North Korean hackers have successfully stolen more than $400 million in cryptocurrency over an 18-month period by utilizing a sophisticated social-engineering scheme known as FaceStealer. By combining AI-generated deepfakes with prerecorded webcam footage, the attackers impersonate trusted figures to gain the confidence of targets within the crypto industry and open-source development community.

What happened

The FaceStealer operation functions as a trap during video conference calls. Hackers initiate contact using accounts stolen from previous victims to lure targets into meetings. Once the call begins, the attackers play prerecorded webcam footage of trusted contacts to simulate their presence. To enhance the deception, the group also employs AI to generate deepfake videos of well-known figures within the crypto sector.

After establishing a sense of trust, the attackers manufacture a fake technical glitch, such as claiming the audio is not working. They then provide the target with a link to "fix" the issue, which actually installs malware on the victim's device. This malware allows the hackers to drain cryptocurrency wallets or exploit the victim's access to other systems. In some instances, the attackers wait months or even over a year after the initial infection before executing their theft. The FBI has seized over 900 webcam recordings of victims as part of their investigation into the infrastructure behind this operation. The DOJ has linked these activities to North Korean groups including Sapphire Sleet, BlueNoroff, and APT38, noting an increasing focus on open-source software developers to facilitate potential supply-chain attacks.