DOJ DISRUPTS NORTH KOREAN FACESTEALER CYBER CAMPAIGN AND MOVES TO SEIZE $1.2 BILLION IN STOLEN BINANCE CRYPTOCURRENCY

WASHINGTON, D.C. — The U.S. Department of Justice announced coordinated federal actions on November 12, 2026, targeting two major North Korean cryptocurrency theft operations, including the disruption of a sophisticated cyber campaign known as FaceStealer and court authorization to seize or restrain more than $1.2 billion in digital assets stolen from Binance. The operations involve separate North Korean cyber activities that federal authorities have connected to efforts by the Democratic People’s Republic of Korea (DPRK) to generate illicit revenue for its government and weapons programs. According to the Justice Department, FaceStealer has resulted in more than $400 million in cryptocurrency theft over the past 18 months, while a separate October 29 attack attributed to North Korean military-linked hackers resulted in the theft of more than $6 billion from the Binance cryptocurrency exchange.

The FaceStealer operation represents a particularly sophisticated form of social engineering that combines compromised communication accounts, secretly recorded webcam footage, fabricated video conferences, malicious software, and artificial intelligence-generated deepfakes. Federal investigators attributed the campaign to North Korean state-sponsored cyber actors publicly tracked under several names, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima. These designations are associated with North Korean cyber operations and reflect naming conventions used across security investigations.

According to the FBI’s November 12 FLASH advisory, the campaign begins with the compromise of an individual’s computer or communication accounts. Attackers search infected devices for cryptocurrency wallets, recovery phrases, stored credentials, and access to sensitive systems. They also obtain contact lists, communication histories, and webcam recordings that can be used to impersonate the victim during additional attacks. North Korean operators have hijacked accounts associated with Telegram, LinkedIn, Slack, and Discord, allowing them to approach new targets through communication channels that appear familiar and trustworthy.

After obtaining control of an account, the hackers contact people connected to the victim and propose online meetings involving business collaboration, investment opportunities, or ordinary professional discussions. The invitations often arrive through legitimate accounts controlled by the attackers, creating the appearance that the meeting was organized by someone the recipient already knows. Scheduling services, including Calendly, may be used to arrange the meeting before the attackers deliver a fraudulent video conference link shortly before the scheduled appointment.

The malicious links direct victims to attacker-controlled websites designed to imitate Zoom, Microsoft Teams, and similar video conferencing platforms. The FBI identified examples of deceptive domains, including uu01webzoom.us and teams.livemeet.us, that were registered to resemble legitimate meeting services. Once a target enters the fraudulent conference environment, prerecorded webcam footage of an earlier victim is displayed to simulate a real conversation. Additional recordings can create the appearance of a group meeting attended by several familiar individuals.

North Korean hackers have expanded this technique through artificial intelligence-generated deepfake videos depicting prominent individuals from the cryptocurrency and Web3 industries. The FBI reported that publicly available photographs and recordings can be manipulated into convincing simulated webcam appearances. The resulting footage allows attackers to impersonate recognizable industry figures without first obtaining private recordings of those individuals. Although deepfakes have become part of the campaign, federal investigators emphasized that FaceStealer continues to rely predominantly on genuine webcam footage collected from previous victims.

Once the target believes the meeting is legitimate, the attackers introduce a fabricated technical problem, frequently claiming that the participant’s microphone is not functioning or that other attendees cannot hear them. The victim is instructed to follow an update prompt, execute a script, or paste commands into the computer’s terminal to restore the meeting’s functionality. Instead of resolving a technical issue, those instructions install malicious software capable of stealing browser cookies, recording keystrokes, capturing screenshots, and establishing unauthorized access to the infected device.

The malware gives attackers opportunities to steal cryptocurrency, compromise business systems, and obtain access to additional communication accounts. In several cases documented by the FBI, the theft of cryptocurrency or further account compromises occurred months or more than a year after the initial infection. Hackers sometimes retained stolen recovery phrases and monitored cryptocurrency wallet balances before transferring funds when the accounts accumulated additional assets. This delayed exploitation allows a compromised device or wallet to remain a source of financial exposure long after the original malicious meeting has ended.

Federal authorities confirmed that the FBI seized more than 900 webcam videos associated with FaceStealer through a court-authorized operation. The recordings had been collected without the victims’ knowledge and used to impersonate them in additional attacks. Investigators identified the video archive as a central component of the campaign’s ability to exploit personal and professional relationships, allowing one successful compromise to generate new opportunities for deception and malware distribution.

The FBI also warned that FaceStealer has expanded beyond cryptocurrency theft into attempts to compromise the open-source software supply chain. North Korean operators have targeted software developers and maintainers who control repositories and widely distributed software packages. By obtaining access to those accounts, attackers can attempt to insert malicious dependencies into legitimate software projects, potentially exposing organizations and individual users who download affected components.

One incident described in the FBI advisory involved a maintainer associated with a major open-source JavaScript library receiving tens of millions of downloads each week. The attackers used a fraudulent Microsoft Teams meeting featuring simulated participants, including an individual recognizable to the target. After being persuaded to perform corrective actions for a fabricated technical problem, the maintainer unknowingly infected his computer. The attackers then exploited his access to create malicious dependencies intended for distribution through the software project.

The attempted supply-chain compromise was detected and disrupted before it could produce the widespread victimization that federal investigators feared. The FBI identified additional attempts involving software repositories associated with the Node Package Manager (NPM) ecosystem and Rust crates. These incidents demonstrate how the same social engineering infrastructure used to steal cryptocurrency can be redirected toward compromising software that is distributed to large numbers of downstream users. The Bureau’s advisory identifies developer account security and repository access as major concerns for organizations dependent on open-source components.

Separately, the Justice Department provided updated information concerning the October 29 Binance cryptocurrency theft attributed to North Korean military-linked cyber actors identified by the FBI as TraderTraitor. The attackers stole more than $6 billion in virtual assets, triggering an extensive tracing and asset recovery operation involving federal investigators and private-sector cryptocurrency infrastructure providers. The Department confirmed that more than $2.7 billion had been frozen through coordinated action, while federal courts had authorized the seizure or restraint of more than $1.2 billion of that amount.

The stolen assets have been moved through cryptocurrency bridges, mixing services, exchanges, and other mechanisms used to obscure transaction histories and make recovery more difficult. Federal investigators continue to examine blockchain transactions and identify destinations associated with the laundering operation. The FBI previously issued a cyber alert identifying cryptocurrency addresses associated with TraderTraitor and urging virtual asset service providers to prevent transactions involving those addresses or assets traceable to them.

The Binance recovery effort includes the Justice Department’s National Security Cyber Section, the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS), and the U.S. Attorney’s Office for the District of Columbia. The FBI’s Los Angeles Field Office, Cyber Division, and Virtual Asset Unit are coordinating investigative efforts with the United States Secret Service and Internal Revenue Service Criminal Investigation. Federal officials identified rapid cooperation with cryptocurrency companies as a critical factor in preventing a substantial portion of the stolen assets from moving beyond immediate enforcement reach.

Principal Deputy Assistant Attorney General for National Security M. Scott Proctor connected North Korea’s cryptocurrency operations to the regime’s efforts to finance prohibited activities and weapons development. Assistant Attorney General A. Tysen Duva emphasized the Criminal Division’s role in coordinating with the virtual asset industry to freeze stolen funds. U.S. Attorney Jeanine Ferris Pirro for the District of Columbia and First Assistant U.S. Attorney Bill Essayli for the Central District of California also addressed the enforcement actions, emphasizing the government’s continued pursuit of assets stolen through state-sponsored cybercrime.

FBI Cyber Branch Operations Director Brett Leatherman identified the FaceStealer campaign as an established threat to cryptocurrency holders and professionals working within the Web3 sector. Assistant Director in Charge Patrick Grandy of the FBI’s Los Angeles Field Office warned that the campaign can deceive technically experienced individuals because it exploits trusted communication accounts, familiar relationships, and the ordinary appearance of widely used video conferencing services.

The FBI’s defensive guidance emphasizes joining meetings through official conferencing applications using verified invitation codes, confirming unexpected meeting requests through a separate communication channel, and refusing instructions to execute scripts or terminal commands presented as meeting repairs. The Bureau also recommends delaying webcam activation until participants can be authenticated, enabling multifactor authentication on communication platforms, and keeping cryptocurrency recovery phrases and private keys away from devices exposed to potential compromise.

Individuals who suspect they have been targeted are advised to secure cryptocurrency holdings through newly created wallets on uncompromised devices, terminate unauthorized communication sessions, change account credentials, and notify contacts who may receive fraudulent messages from hijacked accounts. Software developers and maintainers are also encouraged to secure repository credentials and notify employers or affected organizations when a compromise may have exposed professional systems. The FBI directs victims to report incidents through the Internet Crime Complaint Center using the keyword FaceStealer.

The disruption of FaceStealer infrastructure was led by Assistant U.S. Attorney Khaldoun Shobaki for the Central District of California and the FBI’s Los Angeles Field Office. The separate Binance recovery operation remains active as federal authorities continue tracing stolen assets and coordinating with financial institutions and digital asset service providers.

The November 12 enforcement actions expose two dimensions of North Korea’s cybercrime operations: targeted social engineering designed to compromise individuals and software infrastructure, and large-scale cryptocurrency theft followed by efforts to conceal and move stolen assets. The FaceStealer campaign also demonstrates how access obtained through personal deception can become a threat to widely distributed software, placing developers, organizations, and downstream users at risk. The coordinated federal response addresses both the infrastructure enabling these intrusions and the financial channels used to move their proceeds.

Federal Bureau of Investigation, North Korean Hackers Use Secretly Recorded Webcam Library of 900+ Tech Workers in $400M “FaceStealer” Crypto Theft Scheme, FBI FLASH, November 12, 2026, FLASH Number AC-111226-MS, TLP:CLEAR. (Free Download)

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE