Key Highlights
- US authorities seized cloud infrastructure linked to the FaceStealer campaign in an operation separate from the Binance investigation.
- Attackers used deepfake videos and pre-recorded footage during video calls to impersonate people trusted by their targets.
- The campaign allegedly stole more than $400 million in crypto assets over 18 months and targeted cryptocurrency, Web3 and open-source software communities.
US Authorities Seize FaceStealer Infrastructure
US authorities have seized the cloud infrastructure used in the FaceStealer campaign, in an operation separate from the Binance investigation. The action targeted digital infrastructure connected to a campaign that allegedly caused more than $400 million in cryptocurrency losses over an 18-month period.
According to the statement, the attackers used deepfake videos and pre-recorded footage during video calls to impersonate people their targets already knew or trusted. By presenting convincing digital representations of familiar contacts, the campaign sought to make fraudulent interactions appear legitimate.
FaceStealer Targeted Crypto and Open-Source Developers
The investigation focused on attacks against people working in the cryptocurrency and Web3 sectors, along with open-source software developers. These communities often collaborate remotely and communicate through online meetings, creating opportunities for attackers to exploit trusted professional relationships.
As part of the investigation, the FBI seized more than 900 security camera recordings belonging to victims. The recordings form part of the evidence collected in connection with the campaign and its targeting of individuals involved in cryptocurrency, Web3 and open-source software development.
Why This Matters
The FaceStealer operation highlights how deepfake videos and recorded footage can be used alongside social engineering to target professionals in technology-focused industries. The seizure of cloud infrastructure and victim-related recordings indicates that US authorities are pursuing both the technical systems supporting cybercrime campaigns and evidence associated with their victims.
The operation also underscores the security risks facing cryptocurrency and Web3 participants, as well as open-source developers who frequently rely on video calls and remote collaboration. The investigation remains distinct from the Binance investigation, and the reported seizure represents an enforcement action connected specifically to the FaceStealer campaign.
Frequently Asked Questions
What is the FaceStealer campaign?
FaceStealer is the campaign investigated by US authorities after attackers used deepfake videos and pre-recorded footage to impersonate trusted individuals during video calls.
Who did FaceStealer target?
The campaign targeted people working in the cryptocurrency and Web3 sectors, as well as open-source software developers.
How much cryptocurrency was allegedly stolen?
The campaign resulted in the theft of more than $400 million in crypto assets over 18 months.
This is not investment advice.
