U.S. Accuses North Korean Hackers of Stealing More Than $400 Million in Cryptocurrency

The U.S. government says North Korean hackers stole more than $400 million in cryptocurrency, equivalent to about 2.2 billion Brazilian reais at the direct exchange rate. The Justice Department said the thefts were intended to fund the “authoritarian regime” of North Korean leader Kim Jong-un. U.S. authorities allege the hackers used social engineering and artificial intelligence to deceive their targets.

Investigators say the hackers lured people into virtual meetings using video from accounts that had been stolen from other individuals. During the calls, the suspects reportedly recorded footage that could be reused later. They also told participants that a technical problem had occurred and sent them a link to fix it.

Clicking the link installed malware on victims’ computers, according to the account of the operation. The malicious software was capable of stealing cryptocurrency. Investigators say the deception combined the appearance of a routine technical issue with access to people who had been drawn into online conversations.

The operation also relied on deepfakes: altered videos that make it appear that someone said or did something they did not. The alleged aim was to create false images of influential figures in the cryptocurrency industry and make the meeting invitations seem more trustworthy. The Justice Department said it had seized cloud-storage infrastructure used by the suspects and announced coordinated actions targeting North Korean hackers.

Earlier in November, the FBI made similar accusations against North Korea, saying hackers from the country carried out what it described as the largest attack in cryptocurrency-industry history. The target was Binance, the industry’s largest exchange, which lost $6.3 billion—roughly 34 billion Brazilian reais—in the attack. North Korea’s government denied responsibility and called the allegation “absurd and nothing new.”