The U.S. Department of Justice seized cloud infrastructure used in FaceStealer, a North Korean-linked social-engineering campaign that the FBI says stole more than $400 million in cryptocurrency over the past 18 months.

In the same November 12 announcement, the department said it had obtained court approval to seize or restrain more than $1.2 billion in crypto stolen from Binance. The actions concern separate operations: FaceStealer targeted cryptocurrency holders and people working in the open-source software supply chain, while the Binance theft was attributed to the TraderTraitor group.

FaceStealer operators used compromised accounts to send invitations to video meetings that appeared to come from trusted contacts. Victims joined calls where attackers played secretly recorded webcam footage of people they knew; in some cases, they used AI-generated deepfakes of well-known figures in the crypto and Web3 industries. A fake technical problem then prompted victims to follow instructions or click a link that installed malware, giving attackers access to their devices, accounts and cryptocurrency. The tactic echoes the deepfake video calls and ClickFix lures described in an earlier report on North Korean crypto-targeting campaigns.

Authorities seized more than 900 webcam videos of victims. The DOJ said the North Korean actors behind the campaign are publicly tracked under several names, including Sapphire Sleet, UNC1069, Dangerous Password, APT38 and BlueNoroff. Officials also said the campaign increasingly targeted people involved in developing and maintaining open-source software, potentially to gain access to repository accounts and enable software supply-chain attacks. Reuters also reported the FBI’s estimate of more than $400 million in cryptocurrency theft.

READ
Chrome Zero-Day CVE-2026-125350 Patched After Exploitation

The separate Binance action concerns the October 29 theft of roughly $6.3 billion. The DOJ said court orders cover more than $1.2 billion in assets, part of more than $2.7 billion frozen by U.S. authorities and private-sector partners. The recovery effort follows Binance’s earlier report that $2.85 billion had been frozen or intercepted and TRM Labs’ attribution of the theft to TraderTraitor.


Buy ExpressVPN with PayPal or Credit Card
Advertisement