BlueNoroff

FBI Disrupts North Korean BlueNoroff FaceStealer Campaign That Stole Over $400 Million in Crypto Using Deepfakes

The FBI has confirmed that North Korean threat actors linked to BlueNoroff stole more than $400 million in cryptocurrency over the past 18 months through the FaceStealer social engineering operation. The campaign combines recorded victim videos, deepfake technology, and ClickFix lures to compromise targets in the cryptocurrency and Web3 sectors. Infrastructure used in the attacks has been seized, alongside $1.2 billion in additional crypto linked to the TraderTraitor group. The operation also targets software developers and open-source maintainers to enable supply chain attacks, as demonstrated by the compromise of the Axios npm package. BlueNoroff has expanded its tactics with generative AI tools from ChatGPT, Grok, and other platforms to create convincing avatars and synthetic videos. The campaign has affected over 677 targets across 58 countries, with a heavy focus on C-suite executives and founders controlling crypto assets.