US Justice Department seizes infrastructure tied to North Korea’s $400M FaceStealer crypto scheme
Authorities disrupted a social-engineering operation that targeted crypto and Web3 workers and froze more than $1.2 billion tied to the Binance theft
The US Department of Justice has seized infrastructure behind North Korea’s FaceStealer scheme. It also froze more than $1.2 billion in crypto stolen from Binance.
FaceStealer is a social-engineering operation that reportedly generated thefts exceeding $400 million over the last 18 months. The people it targeted were mostly in crypto.
What authorities took down
The FBI and the DOJ announced the action between November 10 and 12, 2026. The coordinated effort disrupted cloud-based infrastructure that supported the FaceStealer scheme.
The operation went after several state-sponsored hacking groups linked to North Korea. They are tracked under the names Sapphire Sleet, UNC1069, Stardust Chollima, APT38 and BlueNoroff.
Investigators seized more than 900 webcam videos that had been secretly recorded from victims. The recordings were tied to fraudulent video-conferencing sessions used in the scheme.
Most of those victims worked in crypto and Web3. The targets also included maintainers of open-source software.
The crypto and markets news you actually need—every morning.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
The Binance money trail
The FaceStealer disruption came alongside a larger asset freeze. The DOJ froze more than $1.2 billion in digital assets that it linked to North Korean actors and to the theft from Binance.
On October 29, 2026, the Binance theft was attributed to North Korean groups. The total taken came to more than $6 billion.
The freezes have arrived in stages. An estimated $2.8 billion was frozen first, and the latest actions added the further $1.2 billion.
The $400 million credited to FaceStealer is a separate number. It reflects thefts linked to the video-call scheme over 18 months, not the Binance incident.
Why social engineering keeps working
FaceStealer did not need to break any cryptography. It relied on people trusting what they saw on a video call.
More than 900 recorded victims is a sobering count. Each recording stands for at least one moment when someone thought they were simply taking a meeting.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.
