The US Department of Justice has announced coordinated actions against North Korea's schemes to fund its regime through the massive theft of cryptocurrency, including the disruption of a social engineering operation that stole more than $400 million in just 18 months.
The actions include the seizure of cloud-based infrastructure used in the scheme the FBI is calling "FaceStealer", which has resulted in the theft of more than $400 million worth of cryptocurrency, and the court-authorised seizure and restraint of more than $1.2 billion worth of cryptocurrency recently stolen from Binance, the world's largest crypto exchange.
"The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," said FBI Cyber Branch Operations Director Brett Leatherman. "North Korean cyber actors have used the FaceStealer scheme to aggressively target individuals in the cryptocurrency and Web3 sectors through deceptive social engineering tactics, resulting in the theft of more than $400 million in the last 18 months."
FaceStealer works by luring targets to video chats on imposter versions of popular video meeting software such as Zoom, Microsoft Teams and Google Meet. The victims — typically people working in cryptocurrency and Web3, along with developers who maintain widely used open-source software — are tricked into installing malware, often after being shown a fake "audio error" message. The attackers secretly record webcam video and use artificial intelligence to create deepfake videos of well-known people in the crypto industry to target their contacts.
The FBI said it had identified and seized more than 900 webcam videos belonging to victims around the world. The scheme was aimed not only at stealing funds directly but at compromising the software repositories controlled by open-source developers, as a first step towards creating supply-chain attacks.
The FBI attributed the activity to a cluster of North Korean hackers known as "Sapphire Sleet", also tracked as UNC1069, Stardust Chollima, APT38, BlueNoroff, Dangerous Password and CryptoCore, and widely regarded as an offshoot of the Lazarus Group. The FBI has published a detailed report on the mechanics of the scheme, including best practices to protect against it, and created a dedicated website, fbi.gov/facestealer, as a central hub for resources.
Separately from the FaceStealer campaign, the Justice Department said that on or about October 29, members of the North Korean military, referred to by the FBI as "TraderTraitor", stole more than $6 billion worth of virtual assets from Binance in an attack that took just 20 minutes — described as the largest bank heist in human history.
The authorised seizure of more than $1.2 billion is part of a broader effort by US authorities and private companies that has frozen more than $2.7 billion of the more than $6 billion stolen from Binance. The FBI had previously blamed the $6.3 billion heist on TraderTraitor, a North Korean hacking operation also linked to the Lazarus Group.
The announcements came on a grim day for crypto markets. Bitcoin fell below $72,000 on Thursday, reaching its lowest level since August, as heavy liquidations, persistent ETF outflows and renewed inflation concerns pressured prices. More than $650 million in crypto positions were liquidated over 24 hours, and US spot Bitcoin ETFs recorded outflows for a fifth consecutive session.
For the crypto industry, the FaceStealer disruption is both a warning and a measure of how far North Korean hacking has evolved. The scheme did not break encryption or exploit a flaw in a blockchain; it exploited trust — a familiar face on a video call, a plausible meeting invitation, a small technical glitch. The FBI's message is that the defence is vigilance, and that the attackers, for all their sophistication, still depend on their victims clicking first.
Market figures in this report were checked at 07:20 PKT on 13 November 2026.
This post is market news information only, not financial advice.
