The US Department of Justice announced on November 12, 2026 (US time) that it had seized cloud-based infrastructure used in "FaceStealer," a scheme in which North Korean hackers abuse video meetings to steal cryptocurrency. According to the department, the scheme has stolen more than $400 million over the past 18 months. In the same announcement, the DOJ said that, in a separate case, a court had authorized the seizure and restraint of more than $1.2 billion of the crypto assets stolen from exchange Binance on or about October 29.

This article is based on the DOJ press release "Justice Department Announces Actions to Disrupt North Korea's Massive Theft of Cryptocurrency" (Press Release Number 26-1356, November 12, 2026).

FaceStealer Infrastructure Seized, Along With More Than 900 Victim Recordings

According to the DOJ, FaceStealer is a social engineering campaign that targets cryptocurrency holders and people working in the open-source software supply chain. The cryptocurrency stolen over the past 18 months exceeds $400 million, and there were also attempts to compromise people involved in open-source development.

The action was led by the US Attorney's Office for the Central District of California and the FBI's Los Angeles Field Office, with the DOJ's Criminal Division, its National Security Division, and the US Attorney's Office for the District of Columbia also taking part. Under a federal warrant, the FBI also seized more than 900 webcam videos of FaceStealer victims.

Recorded Footage of Acquaintances and a Fake Glitch Lead Victims to Install Malware

The announcement describes the scheme as follows:

  • The hackers invite a target to a video meeting using accounts stolen from previous victims
  • Once the target joins, they secretly record the target's webcam. At the same time, they play prerecorded video of a previous victim the target knows, making it look as if the target is talking to a trusted contact
  • They sometimes use deepfake videos of well-known figures in crypto and Web3 during meetings
  • They stage a fake technical problem, such as the target not being heard, and provide a link or steps to fix it. Running this "fix" installs malware
  • From the compromised computer, they steal cryptocurrency or use it as a foothold into other systems. In some cases, theft or account hijacking happened several months to more than a year later

The attackers also read contact lists, social media, and messaging app conversations from compromised devices. Webcam footage of new victims becomes material for deceiving the next target. In the press release, the DOJ itself uses the term "super intelligence (SI)" for the technology the hackers used to create deepfakes of well-known individuals.

The Attackers Are Known by Names Such as APT38 and BlueNoroff

The DOJ says FaceStealer was carried out by North Korean hackers known publicly as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima. These are names assigned by security companies and others, and the department says the North Korean government funds its regime through cryptocurrency theft.

More Than $1.2 Billion From the Binance Theft Seized or Restrained

The same announcement also addressed an incident separate from FaceStealer: on or about October 29, more than $6 billion worth of crypto assets was stolen from Binance. The DOJ attributes the theft to members of the North Korean military that the FBI calls "TraderTraitor." Of the stolen assets, more than $1.2 billion has been seized or restrained with court authorization, and freezes by government and the private sector total more than $2.7 billion.

The FBI Released a Report on Countermeasures and a Dedicated Page

The FBI released a report with best practices and steps for victims, and set up a dedicated page with information on FaceStealer. The entry point of the scheme is a video meeting invitation, and the invitation comes from a real account stolen from a previous victim. Even if the sender's name and face belong to someone you know, that alone is not a sign that the meeting is safe.

Our Take

In our view, what makes this scheme troublesome is less the quality of the deepfakes than its use of real acquaintances' accounts and real recorded footage of them. The traditional reassurance of seeing someone's face and hearing their voice no longer works well. If someone asks you mid-meeting to install a tool because they cannot hear you, a practical response is to leave the meeting and confirm with the person through a separate channel, such as a phone call.

In Japan as well, there are many crypto holders, Web3 company employees, and open-source developers who could be targeted by the same scheme. Given that more than a year can pass between infection and the actual theft, anyone who remembers installing something during a suspicious video meeting may want to consider having their device checked.

Summary

The US Justice Department announced that it seized the infrastructure of FaceStealer, a North Korean scheme that steals cryptocurrency through video meetings, and said losses exceed $400 million over the past 18 months. The scheme combines recorded footage of acquaintances, deepfakes, and fake technical glitches to get victims to install malware. In the separate Binance theft, a court authorized the seizure and restraint of more than $1.2 billion in assets.