FBI Disrupts North Korean FaceStealer Crypto Hack Linked to USD 400 Million Theft - Analytics Insight
The FBI has disrupted a North Korea-linked cryptocurrency hacking operation known as FaceStealer, allegedly responsible for stealing over USD 400 million through fraudulent video meetings.
The FBI and US Department of Justice identified the campaign, which targeted cryptocurrency professionals and software developers, exploiting trusted relationships to compromise devices and steal digital assets.
Attackers used compromised accounts on Telegram, LinkedIn, Slack and Discord to contact potential victims, directing them toward counterfeit Zoom, Microsoft Teams and Google Meet websites.
Victims encountered fabricated audio problems and instructions to install supposed fixes, actions that instead downloaded malware capable of recording keystrokes, capturing screens and accessing sensitive information.
Attackers also secretly recorded victims' webcams, using the footage to impersonate them during subsequent attacks.
FBI seizes infrastructure and recordings
US investigators seized infrastructure supporting FaceStealer and recovered more than 900 webcam recordings collected during the campaign.
Cybersecurity firm Arctic Wolf researchers identified over 677 targets across 58 countries.
The FBI also uncovered an attack involving a JavaScript library maintainer whose compromised computer enabled malicious software modifications.
This is not something we can patch
Authorities stopped the threat before widespread distribution.
Binance hack investigation recovers $1.2 billion
Separately, US authorities linked North Korean hackers to Binance's reported USD 6.3 billion cryptocurrency theft in October 2026.
The Justice Department informed that court orders authorized the seizure or restraint of more than USD 1.2 billion connected to the attack.
Public and private interventions had already frozen over USD 2.7 billion, including the court-restrained assets.
Investigators attributed the Binance incident to North Korea's TraderTraitor group, although officials believe FaceStealer involved different actors.
Cryptocurrency security concerns intensify
FBI cyber director Brett Leatherman said North Korea uses cryptocurrency theft proceeds to finance illicit weapons programs.
The investigation highlights how attackers exploit human trust rather than relying exclusively on technical vulnerabilities.
For cryptocurrency businesses, stronger employee verification, restricted system permissions and independent confirmation of unexpected software instructions remain essential safeguards against increasingly sophisticated impersonation attacks.
Related
