FBI Disrupts North Korean FaceStealer Crypto Theft Campaign
The DOJ and FBI seized infrastructure behind FaceStealer, a North Korean scheme that used fake video calls to steal over $400 million in crypto in 18 months.
⚡ Why it matters
The campaign targets crypto workers, developers and open-source maintainers with invitations that appear to come from colleagues they know. Any "audio problem" during a call that asks you to download a fix could be a trap.
On November 12, 2026, the U.S. Justice Department announced it had disrupted the cloud infrastructure behind a campaign the FBI calls "FaceStealer" and attributes to North Korean state hackers. According to the department, the operation stole more than $400 million in cryptocurrency over the past 18 months.
How the scam works
The victim receives a video-meeting invitation, often a Calendly invite or a Zoom or Teams link, sent from the hijacked account of an acquaintance who was compromised earlier. During the call, the attackers record the victim's webcam and play pre-recorded clips of earlier victims the target knows, making it look as if colleagues are present. The department says the attackers also used deepfake videos of well-known figures in the crypto industry.
Then comes a staged technical glitch, such as the other side claiming they can't hear you, followed by a link to a "fix" that actually installs malware. From the infected machine, the attackers steal cryptocurrency and take over messaging accounts such as Telegram, LinkedIn, Slack and Discord to lure the victim's contacts, sometimes months after the initial compromise.
Why target developers?
The department notes that the campaign increasingly went after open-source developers and maintainers to reach their machines and code-repository accounts, a focus it describes as apparently intended to enable software supply chain attacks.
Who is behind it?
The FBI attributes the activity to a group tracked in the private sector under names including Sapphire Sleet, UNC1069, BlueNoroff, APT38 and Stardust Chollima. Under a court order, the Bureau seized more than 900 webcam recordings of victims around the world and has contacted many of them.
The announcement coincided with a separate action to recover part of the funds stolen in last month's Binance breach.
🔗 Sources
- U.S. Department of Justice: Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency
- FBI: FaceStealer Cryptocurrency Theft Scheme
- The Record: Feds announce seizure of $1.2 billion from Binance theft; also takedown of FaceStealer tools
- BleepingComputer: US disrupts North Korean campaign behind $400 million crypto theft
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Operation TorNado: 354 Dark Web Vendors and Buyers Arrested
Europol and the US Justice Department announced 354 arrests of vendors and buyers on dark web markets including Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom, in a 14-country operation called TorNado.
German Law Gives Spy Agencies Hacking and Sabotage Powers
Germany's Bundestag passed a law on Friday letting intelligence agencies hack foreign systems, disrupt adversaries' supply chains and knock offline servers operated by hostile state hacking groups.
ArcticRAT Android Malware Uses AI to Profile Victims
Zimperium reports that ArcticRAT has evolved from an Android crypto stealer into a remote access Trojan (RAT) that takes over devices and uses an AI model to sift stolen messages for financial information.