Washington says North Korea funds weapons program with crypto theft

The U.S. Justice Department accused Pyongyang of funding its weapons program through cryptocurrency theft and announced the seizure of more than $1.2 billion in stolen Binance funds. The FBI said North Korean hackers stole $400 million over 18 months.

The U.S. Justice Department said Thursday that the North Korean government relies on cryptocurrency theft to fund its regime and illicit weapons program, announcing a series of coordinated measures to pursue the funds.

M. Scott Proctor, the deputy assistant attorney general for national security, said, “The North Korean government funds its rogue regime and illicit weapons program through cryptocurrency theft,” adding that the announcement shows the United States “will counter” the regime’s efforts to profit from cybercrime.

A general view of Pyongyang, the capital of North Korea

$1.2 billion from Binance theft

The department said it had obtained court authorization to seize or freeze more than $1.2 billion in digital assets stolen from Binance, the world’s largest cryptocurrency exchange, on October 29. The theft was part of an operation worth a total of $6.3 billion. U.S. authorities attribute the attack to the North Korean group TraderTraitor, which is linked to the Lazarus Group.

Brett Leatherman, the FBI’s cyber division chief of operations, said, “The North Korean regime relies heavily on the proceeds of cryptocurrency theft to fund its illicit weapons program and has stolen billions of dollars in recent years.”

Fake video calls and stolen faces

In a second action, authorities dismantled the cloud infrastructure of a scheme the bureau calls FaceStealer, which it says enabled North Korean hackers to steal more than $400 million over 18 months. The scheme relies on meeting invitations sent through fake versions of applications such as Zoom and Teams from compromised accounts belonging to people known to the victim. The invitations feature a secretly recorded video of a previous victim. After creating the impression of an audio malfunction, the victim is asked to download an “update” that is actually malware designed to steal cryptocurrency.

The FBI seal on its building in Washington

The bureau seized more than 900 video recordings of victims, while the hackers have also begun using AI-generated videos of prominent figures in the cryptocurrency industry. Investigators link the scheme to a group known by several names, including Sapphire Sleet, APT 38 and BlueNoroff. They say the group also targets open-source software developers, apparently as preparation for attacks on software supply chains.

Images: Wikimedia Commons, Reuters

Washington says North Korea funds weapons program with crypto theft