Pierluigi Paganini
November 13, 2026
The U.S. Department of Justice announced two separate but connected actions against North Korea ‘s cryptocurrency theft operations. The press release covers the seizure of infrastructure behind a social engineering scheme called FaceStealer and court-authorized seizures tied to the $6 billion Binance theft of October 29. Together, the two moves put more than $1.2 billion back under law enforcement control.
“Today the Department of Justice announced coordinated actions against the Democratic People’s Republic of North Korea (DPRK) government’s schemes to fund its regime through the massive theft of cryptocurrency.” states the press release published by DoJ. “These actions include the seizure of cloud-based infrastructure used in the FaceStealer social engineering scheme that has resulted in the theft of more than $400 million worth of cryptocurrency and the court-authorized seizure and restraint of more than $1.2 billion worth of cryptocurrency recently stolen from Binance, a virtual currency exchange.”
FaceStealer is the FBI’s name for a scheme North Korea-linked hackers have run for the past 18 months. The same actors go by Sapphire Sleet, BlueNoroff, APT38 and several other tracking names depending on who is writing the report. They’ve stolen more than $400 million that way, and they’ve also started targeting people who build and maintain open-source software, trying to reach the accounts and repositories those developers control.
The process is quite specific. The hackers send meeting invitations from accounts they have already stolen. This makes the invitations look as if they come from someone the target knows and trusts. During the meeting, they play a recorded video of a previous victim or use a deepfake showing a well-known person in the cryptocurrency or Web3 industry. They use advanced AI tools to create convincing videos of influential people, making the FaceStealer scheme more effective.
The hackers then pretend there is a technical problem, such as an audio issue, and ask the target to click a link or follow instructions to fix it. This leads to the installation of malware. In several cases, the attackers waited months, or even more than a year, before stealing cryptocurrency or taking control of accounts. They also used each victim’s contact lists, social media accounts and messaging apps to identify and approach new targets.
Under a federal warrant, the FBI seized more than 900 webcam videos recorded from FaceStealer victims.
“The FBI today published a report providing greater detail on the mechanics of the FaceStealer scheme, including best practices to protect against this scheme and steps victims can take in the event of a compromise. Additionally, the FBI created a website, www.fbi.gov/facestealer, to serve as a centralized hub for resources and information on the scheme.” continues the press release. “The effort to disrupt the FaceStealer campaign was led by Assistant U.S. Attorney Khaldoun Shobaki for the Central District of California and the FBI’s Los Angeles Field Office.”
The operation to seize the infrastructure was led by the U.S. Attorney’s Office for the Central District of California and the FBI’s Los Angeles Field Office.
The mechanics are specific. The hackers send meeting invitations from accounts stolen from earlier victims, so the invite looks like it comes from someone the target knows. Once in the meeting, the hackers play a pre-recorded video of a previous victim or use a deepfake of a well-known person in crypto or Web3 to simulate trusted contacts.
“The North Korean hackers also use super intelligence (SI) to develop deepfake videos of well-known and influential individuals often in the cryptocurrency and web3 industries that make the FaceStealer scheme even more effective.” FBI continues. “Here again, they use the deepfake videos in the meetings with targets to gain the target’s trust.”
Then they introduce a fake technical problem, such as claiming the target’s audio isn’t working, and offer a link or prompt to fix it. The fix installs malware. In several cases the hackers waited months or more than a year after the initial compromise before stealing cryptocurrency or hijacking accounts. They also used each new victim’s contact lists, social media and messaging apps to reach the next round of targets.
The FBI seized more than 900 webcam videos from FaceStealer victims under a federal warrant. It also published a detailed report on the scheme’s mechanics, with best practices and steps for anyone who suspects they’ve been compromised, and created a resource page at fbi.gov/facestealer. The infrastructure seizure was led by the Central District of California and the FBI’s Los Angeles Field Office.
“The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years,” said FBI Cyber Branch Operations Director Brett Leatherman. “North Korean cyber actors have used the FaceStealer scheme to aggressively target individuals in the cryptocurrency and Web3 sectors through deceptive social engineering tactics, resulting in the theft of more than $400 million in the last 18 months. The FBI remains committed to identifying, disrupting, and imposing cost on North Korean actors targeting the virtual asset community.”
Separately, the DOJ has been working since October 29 to freeze and recover the $6 billion stolen from Binance by North Korea’s TraderTraitor unit. Combined government and private-sector efforts have frozen more than $2.7 billion so far, and the DOJ has court authorization to seize or restrain more than $1.2 billion of that. The Criminal Division’s Computer Crime and Intellectual Property Section called it freezing about half of the historic breach before it got beyond law enforcement reach.
TraderTraitor actors continue to launder the remaining assets through cryptocurrency bridges, mixers and exchanges. The FBI, the U.S. Secret Service and IRS Criminal Investigation last week issued a joint cyber alert naming the addresses the actors are using and urging cryptocurrency service providers to block any transactions involving those addresses or funds derived from them.
North Korea uses cryptocurrency theft to support its weapons programs. The U.S. Department of Justice (DOJ) has repeatedly highlighted this link. A senior official from the department’s National Security Division said the regime uses these criminal operations to raise money for its weapons program. The DOJ also pledged to use all available legal tools to seize the stolen funds and return them to their rightful owners.
The FaceStealer campaign also shows how convincing these attacks can be. According to the FBI, the scheme can trick even experienced IT professionals and users who are well aware of cybersecurity risks.
“Efforts to trace, freeze, seize, and forfeit the stolen virtual assets are ongoing, as TraderTraitor actors continue to launder such assets through various cryptocurrency bridges, mixers, and exchanges.” concludes the press release. “For example, last week, the FBI, in coordination with its law enforcement partners at the U.S. Secret Service (USSS) and the Internal Revenue Service (IRS-CI), issued a Cyber Alert attributing the theft and urging VASPs to block transactions with or derived from cryptocurrency addresses TraderTraitor actors are using to launder the stolen Binance assets.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
