North Korean hackers attack cryptocurrency practitioners with FaceDealer scam: over $400 million stolen in 18 months

According to market news, North Korean hackers attacked cryptocurrency practitioners using the "FaceDealer" technique, stealing over $400 million within 18 months. The attackers hijacked the Telegram or LinkedIn accounts of industry insiders familiar to the targets, impersonating them to send meeting invitations, guiding the targets into counterfeit Zoom or Teams meetings that they set up and controlled.

The attackers secretly recorded the targets' cameras to later impersonate their identities; the "inviter" in the meeting was actually a recording of a previous victim, and the attackers pressured the targets with false attendees and statements like "the other party can't hear you." Subsequently, the attackers displayed a forged error message, luring the targets to run a so-called update program that implanted malware, leading to the compromise of their computers, cryptocurrency wallets, and social accounts.

The FBI stated that it has discovered and blocked related recordings from over 900 victims, all of whom are senior practitioners in the fields of cryptocurrency, Web3, and cybersecurity. The FBI also attributed last month's theft of approximately $6.3 billion from Binance to North Korea's "TraderTraitor" operation; the North denied the allegations, calling them "absurd claims."