US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance
US seizes North Korean hacking infrastructure and over $1.2B in crypto stolen from Binance.
The Justice Department announced coordinated actions against North Korean hacking groups, seizing cloud infrastructure used in the FaceStealer social engineering scheme and authorizing the seizure of over $1.2 billion in cryptocurrency stolen from Binance. The FBI attributes the larger operation, involving over $6 billion in stolen virtual assets, to North Korean military hackers known as TraderTraitor. The scheme involves hijacking accounts on platforms like Telegram and LinkedIn to lure victims into fake video meetings via typo-squatted domains, using secretly recorded webcam videos to impersonate victims in follow-on attacks.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Binance?
Get an email when a new story names Binance, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonNorth Korean state-sponsored hackers (TraderTraitor) exploited human trust by impersonating legitimate contacts on LinkedIn and Telegram, luring victims into fake video calls hosted on typosquatted domains to harvest credentials and webcam footage. The stolen recordings were then weaponized to impersonate victims in follow-on attacks, enabling the theft of over $1.2 billion from Binance alone and $6 billion in total virtual assets. This attack chain succeeded primarily because users lacked the awareness to verify meeting links and counterparties before engaging, and because account recovery and access controls were insufficient to prevent hijacked accounts from being used as launchpads. The scale of the operation highlights how social engineering against individuals can cascade into catastrophic financial losses for large institutions.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — FaceStealer