U.S. Disrupts FaceStealer Infrastructure After More Than $400 Million Stolen in 18 Months
Key Facts
The U.S. Justice Department announced on November 12, 2026, that it had disrupted cloud infrastructure used by the North Korean FaceStealer scheme, while the FBI said the campaign had led to the theft of more than $400 million in cryptocurrency over the previous 18 months. The bureau seized, under a federal warrant, more than 900 webcam recordings of the scheme’s victims, the department said. The operators targeted cryptocurrency holders, open-source software developers and maintainers, according to the department’s statement. The department said proceeds from large-scale cryptocurrency thefts fund North Korea’s illicit weapons program. Details of the case show that the targeting extended beyond direct theft of funds to attempts to access software developers’ accounts and supply chains.
One scam began with the compromise of messaging accounts, followed by invitations for targets to join fake meetings on Zoom or Teams. During the meeting, the hacker played a saved webcam recording of a previous victim, according to the FBI’s description. The operators then pushed the target to install malware presented as a technical fix for a problem, according to an alert from the bureau’s Internet Crime Complaint Center. The center said compromising the target’s device allowed the attackers to steal cryptocurrency or exploit access to other computing infrastructure. In some cases, the theft or takeover of communication accounts did not occur until months later, or more than a year after the initial compromise, the Justice Department said.
FaceStealer’s attempts also extended to software developers and repository operators, in an effort to access their accounts and compromise the software supply chain, the FBI said. One attempt targeted a JavaScript library through malicious dependencies, according to the alert. The bureau said the targeted library receives tens of millions of downloads weekly, illustrating the range of users who could be affected if a supply-chain compromise succeeded. A trusted developer account gives an attacker a potential entry point into software relied on by users, according to the bureau’s description of the attempted breach. The campaign thus combined social engineering with the targeting of software development infrastructure, alongside its targeting of digital asset holders.
The FBI said the scheme’s operators had also begun using AI-generated fake videos of prominent figures in the cryptocurrency and Web3 sectors. But it said the campaign still relied mostly on real videos stolen from victims, not deepfakes. The bureau’s alert said victims’ recordings were used during fake meetings to lend credibility to communications with targets. This means fake video was not the primary method the bureau attributed to FaceStealer, despite AI-generated clips becoming part of the operators’ tactics. The bureau attributed the activity to a North Korean group known in the private sector by names including Sapphire Sleet, UNC1069, Stardust Chollima, APT38 and BlueNoroff.
The Justice Department distinguished FaceStealer from the Binance platform theft, which it attributed to North Korean operatives known as TraderTraitor. The department said they stole virtual assets worth more than $6 billion from the platform on or around October 29. It added that public and private efforts had frozen more than $2.7 billion in stolen funds, and that courts had authorized the seizure or restriction of assets worth more than $1.2 billion of that amount. These figures concern the separate Binance case and are not included in the amount of theft the FBI attributed to FaceStealer. The department had said Binance hackers continued to launder money through cryptocurrency bridges, mixers and platforms, while efforts to track, freeze and seize the assets and pursue legal action continued.
Chainalysis estimates place the case within a broader wave of cryptocurrency thefts attributed to North Korea. The company estimated that hackers linked to the country stole at least $2.02 billion during 2025, an increase of $681 million from 2024, or 51% year over year. It said North Korea-linked attacks accounted for a record 76% of service compromises in 2025. In a separate alert dated October 31, 2026, the FBI urged virtual asset service providers and others in the sector to block transactions linked to addresses used by TraderTraitor. The Justice Department continues to pursue assets in the Binance case, while the FBI announced the disruption of cloud infrastructure used in FaceStealer.