The U.S. Justice Department and the FBI have seized the cloud infrastructure behind “FaceStealer,” a North Korean social engineering scheme connected to over $400 million in cryptocurrency theft in the past 18 months.
Announced on November 12, 2026, this action also addresses the separate theft of approximately $6 billion from Binance, which the FBI attributes to the North Korean military group known as “TraderTraitor.”
FBI Disrupts North Korean FaceStealer
FaceStealer is attributed to state-sponsored actors tracked as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima. The operators hijack genuine Telegram, LinkedIn, Slack, and Discord accounts from earlier victims and message the victim’s contacts to propose a catch-up call.
They then send Calendly invitations and, shortly before the meeting, a typo-squatted Zoom or Teams link. Researchers documented the same tradecraft in an AI-generated Zoom lure campaign that used fileless PowerShell.
Once the target joins the fake session, the attackers play secretly recorded webcam footage of earlier victims. This makes it look as though trusted colleagues are in the meeting, and the hackers also record the new target’s camera.
Investigators say they have seized more than 900 such videos. The actors have also begun using “super intelligence” to build deepfakes of well-known crypto and Web3 figures. However, the scheme still relies mostly on genuine stolen footage.
The infection step is simple. The attacker, posing as the trusted contact, claims the victim’s audio is broken and walks them through a “fix.” That fix is an update prompt, a script, or code pasted into a terminal. The result is a cookie harvester, keylogger, screen capturer, and backdoor. In several cases, hackers waited months, even over a year, before draining wallets, and they watched balances grow.
The FBI’s FLASH advisory says defenders should join calls through official apps with invite codes, keep webcams off until they verify the host, and never paste commands to fix a meeting.
The campaign also reaches into software supply chains. The FBI says the actors lured a major open-source JavaScript library maintainer into a fake Teams call earlier this year.
They then tried to publish malicious dependencies to a package that receives tens of millions of weekly downloads, and fast detection stopped the attack. Maintainers on npm and Rust crates have also been targeted.
On the Binance side, US agencies and private partners have frozen more than $2.7 billion. Courts have authorized the seizure or restraint of over $1.2 billion of that. TraderTraitor continues to launder funds through bridges, mixers, and exchanges, converting mostly to Ethereum. The FBI urges virtual asset service providers to block transactions linked to the identified addresses.
Victims should move funds to a new wallet with fresh seed phrases, secure their messaging accounts with multifactor authentication, warn contacts, and report to IC3.gov using the keyword “FaceStealer.”
Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs:
