US Justice Department seizes infrastructure tied to North Korea’s $400M FaceStealer crypto scheme
The US Department of Justice has seized infrastructure behind North Korea's FaceStealer scheme and frozen over $1.2 billion in stolen crypto from Binance.
The coordinated action between November 10-12, 2026, targeted state-sponsored hacking groups including Sapphire Sleet, UNC1069, Stardust Chollima, APT38 and BlueNoroff. The operation disrupted cloud-based infrastructure that supported the FaceStealer scheme, which generated thefts exceeding $400 million over the last 18 months.
Investigators seized more than 900 webcam videos secretly recorded from victims during fraudulent video-conferencing sessions. Most victims worked in crypto and Web3, with some being maintainers of open-source software.
Binance money trail
The FaceStealer disruption coincided with a larger asset freeze. The DOJ froze over $1.2 billion in digital assets linked to North Korean actors and the Binance theft. On October 29, 2026, the Binance theft was attributed to North Korean groups, totaling over $6 billion.
The freezes occurred in stages, with an initial $2.8 billion frozen before the latest $1.2 billion addition. The $400 million credited to FaceStealer represents separate thefts from the video-call scheme over 18 months.
Social engineering success
FaceStealer operated without breaking cryptography, instead exploiting human trust in video calls. The 900 recorded victims represent moments when professionals believed they were attending legitimate meetings.
Related
