FBI Disrupts North Korean Hacking Scheme Targeting Crypto and Web3 Workers, Linked to Over $400 Million in Thefts

The FBI has disrupted a sophisticated social engineering scheme operated by North Korean hackers that targeted professionals in the cryptocurrency and Web3 sectors, leading to over $400 million in thefts over an 18-month period. The operation, identified as “FaceDealer,” employed deceptive tactics involving fake video conferencing meetings to compromise victims.

According to the FBI, the hackers initiated contact by impersonating individuals known to or respected by potential victims. To bolster their credibility, the attackers frequently hijacked victims’ social media accounts, such as Telegram or LinkedIn. Subsequently, victims were lured into seemingly realistic Zoom or Microsoft Teams meetings, which were, in fact, controlled by the hackers.

During these fabricated meetings, the attackers secretly recorded the victim’s webcam. When the meeting began, the victim would see a video feed of the supposed inviter, but this feed was a recording of a previous victim. To increase pressure, additional fake participants were often added, and messages indicating audio issues would prompt the victim to attempt a resolution.

The resolution typically involved the hackers sending a fake update. Executing this update installed malware, granting the attackers access to the victim’s computer, including their cryptocurrency wallets and social media accounts. Special Agent in Charge Jeremy Robertson of the FBI’s Los Angeles field office described the scheme as highly effective, noting that over 900 victims, many of them experienced professionals in crypto, Web3, and cybersecurity, had their webcam footage identified and disrupted by the FBI.

The “FaceDealer” scheme is estimated to have been associated with over $400 million in losses within 18 months. This incident follows previous FBI attributions of significant cryptocurrency theft to North Korean actors. Last month, the FBI stated that a North Korean cyber campaign known as “TraderTraitor” was responsible for a $6.3 billion breach at Binance. In both alleged cases, the attackers reportedly converted stolen funds into Ether (ETH) and laundered them through decentralized finance (DeFi) platforms and instant swap services.

Officials in Pyongyang have strongly denied these accusations, characterizing them as “absurd rhetoric.” They have suggested that the United States might benefit from such allegations, potentially by confiscating recovered stolen funds for its national strategic reserve.

The FBI’s disruption of the “FaceDealer” infrastructure underscores the persistent threat of state-sponsored cybercrime to the digital asset ecosystem. This operation highlights the ongoing risks faced by crypto and Web3 professionals due to sophisticated social engineering tactics. While the FBI has taken action against this specific operation, the broader challenge of North Korea’s alleged involvement in cryptocurrency theft remains a significant concern for industry professionals and global law enforcement.

Why This Matters

The FBI’s disruption of the “FaceDealer” scheme is significant because it highlights the ongoing threat of state-sponsored cybercrime to the cryptocurrency industry. The scheme’s success in stealing over $400 million over 18 months demonstrates the effectiveness of sophisticated social engineering tactics against experienced professionals in the crypto and Web3 sectors.

Broader Context

The FBI has disrupted infrastructure used by North Korean hackers in a social engineering scheme that targeted crypto and Web3 workers. This operation, known as “FaceDealer,” involved fake video meetings to record victims’ webcams, install malware, and impersonate industry professionals, leading to substantial financial losses.