DOJ Disrupts North Korea FaceStealer Scheme and Seizes $1.2B from Binance Hack
Do Son 
TL;DR
Federal authorities dismantled cloud servers powering the North Korea FaceStealer scheme, a deepfake social engineering operation that stole over $400 million in 18 months. Separately, officials obtained court orders to seize over $1.2 billion in digital assets linked to a recent $6 billion Binance exchange breach. Both actions target illicit revenue streams funding North Korea’s weapons programs.
What Happened in the Operations
The Department of Justice announced coordinated actions to disrupt North Korean cryptocurrency heists across two major fronts. In California, the FBI seized cloud infrastructure and over 900 victim webcam recordings tied to the FaceStealer scheme. Hackers used hijacked accounts to invite Web3 workers and open-source software maintainers to fake video meetings. During these calls, the attackers played pre-recorded clips of the victim’s contacts or AI-generated deepfakes of industry leaders.
Next, the operators triggered a fake audio error and sent a link to fix the problem. However, clicking the prompt installed malware that stole cryptocurrency and hijacked communication apps up to a year later. Meanwhile, in a separate case from October 29, 2026, authorities worked with virtual asset service providers to freeze over $2.7 billion and seize $1.2 billion from a $6 billion theft at the Binance exchange.
Who Is Behind the Activity
Investigators attribute both campaigns to North Korean state actors with high confidence based on DOJ findings and joint FBI, Secret Service, and IRS-CI alerts. Specifically, the North Korea FaceStealer scheme is linked to APT38, also tracked by security researchers as BlueNoroff, Sapphire Sleet, Stardust Chollima, and UNC1069. Conversely, the FBI attributes the October 29 Binance intrusion to a North Korean military unit known as TraderTraitor.
“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said Principal Deputy Assistant Attorney General M. Scott Proctor.
Impact and How to Stay Protected
Beyond stealing $400 million over 18 months, FaceStealer operators targeted open-source developers to compromise software repositories and enable supply chain attacks. “It exploits our trust in ubiquitous video conference platforms and valued personal relationships,” said FBI Assistant Director in Charge Patrick Grandy.
Recommended Defense Steps
To defend against the FaceStealer scheme, developers and crypto holders should never run troubleshooting scripts or patches sent during video calls. Furthermore, virtual asset platforms should block wallet addresses listed in the joint FBI, Secret Service, and IRS-CI alert, while potential victims can review recovery guidance at fbi.gov/facestealer.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
