Federal Authorities Disrupt Massive North Korean Cryptocurrency Theft Operations
Law enforcement seized servers behind a $400 million deepfake video scam and froze more than $1.2 billion stolen from Binance.
- By Jesse Jacobs
- Nov 13, 2026
U.S. law enforcement officials have dismantled cloud-based infrastructure used in a North Korean social engineering campaign and secured court authorization to seize more than $1.2 billion in cryptocurrency stolen from the Binance exchange.
The social engineering operation, known as FaceStealer, resulted in the theft of more than $400 million over the past 18 months, according to the Department of Justice and the FBI. State-sponsored hacking groups—including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, Advanced Persistent Threat 38, BlueNoroff and Stardust Chollima—targeted individuals in the cryptocurrency and Web3 sectors as well as open-source software developers.
Attackers compromised victims' accounts to send video meeting invitations to their personal and professional contacts. During the calls, hackers surreptitiously recorded the targets' webcams and played prerecorded footage of prior victims or super intelligence-generated deepfakes of influential industry figures to establish trust.
Once a target was deceived, the attackers simulated a technical error, such as claiming the victim could not be heard, and sent a link or prompt to fix the issue. The purported fix installed malware that allowed the hackers to steal cryptocurrency, hijack communication accounts months or more than a year later and access open-source software repositories to enable supply-chain attacks. Federal agents executed a warrant to seize more than 900 webcam videos of FaceStealer victims.
In a separate action, the Justice Department, FBI, U.S. Secret Service and Internal Revenue Service Criminal Investigation moved to recover virtual assets stolen from Binance on or about Oct. 29. Federal officials attributed the theft of more than $6 billion to North Korean military hackers tracked as TraderTraitor.
Working alongside virtual asset service providers, federal authorities have frozen more than $2.7 billion of the stolen Binance funds, including the $1.2 billion under court-authorized seizure and restraint. Investigators noted that TraderTraitor actors continue attempting to launder the remaining stolen assets through cryptocurrency bridges, mixers and exchanges.