The US Department of Justice has seized infrastructure behind FaceStealer, a North Korea-linked social-engineering scheme, and froze more than $1.2 billion in cryptocurrency stolen from Binance.
The FBI and the DOJ announced the action between Nov. 10 and Nov. 12, 2026. The coordinated effort disrupted cloud-based infrastructure that supported FaceStealer, which reportedly generated thefts exceeding $400 million over the prior 18 months.
Targets and seized material
The operation went after several state-sponsored hacking groups linked to North Korea. They are tracked under the names Sapphire Sleet, UNC1069, Stardust Chollima, APT38 and BlueNoroff.
Investigators seized more than 900 webcam videos that had been secretly recorded from victims. The recordings were tied to fraudulent video-conferencing sessions used in the scheme.
Most of those victims worked in crypto and Web3. The targets also included maintainers of open-source software.
Binance theft and asset freezes
The FaceStealer disruption came alongside a larger asset freeze. The DOJ froze more than $1.2 billion in digital assets that it linked to North Korean actors and to the theft from Binance.
On Oct. 29, 2026, the Binance theft was attributed to North Korean groups. The total taken came to more than $6 billion.
The freezes have arrived in stages. An estimated $2.8 billion was frozen first, and the latest actions added the further $1.2 billion.
The $400 million credited to FaceStealer is a separate number. It reflects thefts linked to the video-call scheme over 18 months, not the Binance incident.
Why social engineering keeps working
FaceStealer did not need to break any cryptography. It relied on people trusting what they saw on a video call.
More than 900 recorded victims is a sobering count. Each recording stands for at least one moment when someone thought they were simply taking a meeting.
