DOJ: North Korea's FaceStealer Stole $400M via Deepfake Video Calls
The DOJ disrupted North Korea's FaceStealer operation, which used AI deepfakes and pre-recorded video to trick crypto workers into installing malware, netting more than $400 million over 18 months. A simultaneous action seeks $1.2 billion of the $6 billion-plus stolen from Binance.
The DOJ seized cloud infrastructure behind a North Korean social-engineering campaign that turned fake video calls into a $400 million heist, while simultaneously moving to claw back $1.2 billion from the largest crypto exchange hack on record.
Key takeaways
- The DOJ disrupted North Korea's FaceStealer scheme on November 12, 2026, which used AI deepfakes and pre-recorded video of trusted contacts to trick crypto and Web3 workers into installing malware, stealing more than $400 million over 18 months.
- In a separate action announced the same day, the DOJ obtained court authorization to seize more than $1.2 billion of the $6 billion-plus stolen from Binance in the October 29 TraderTraitor hack, with more than $2.7 billion frozen in total through public-private cooperation, per the DOJ press release.
- Neither operation required breaking Bitcoin's cryptography. Both exploited the humans and institutions holding keys on other people's behalf.
The DOJ announced on November 12, 2026 that it seized cloud-based infrastructure used in FaceStealer, an FBI-designated North Korean operation that has drained more than $400 million in cryptocurrency over the past 18 months. The same press release announced a court-authorized seizure of more than $1.2 billion tied to the Binance hack, making it the largest single crypto-theft recovery action on record.
How FaceStealer Works
The scheme is methodical. Attackers use stolen accounts from prior victims to invite targets to video conference calls. Once on the call, they play pre-recorded webcam footage of trusted contacts or AI-generated deepfake video of well-known crypto and Web3 figures to establish credibility. When the target's guard is down, they're walked into installing malware that harvests private keys and wallet access.
The FBI attributed FaceStealer to the cluster known in the private sector as Sapphire Sleet, UNC1069, Stardust Chollima, APT38, and BlueNoroff, per the FBI's FaceStealer page. As part of the disruption, the FBI seized over 900 webcam recordings of crypto and Web3 workers, per the FBI's FaceStealer page. Those recordings are a surveillance archive: faces, workflows, and professional relationships catalogued by a nation-state.
FBI Los Angeles Assistant Director in Charge Patrick Grandy put the threat plainly in the DOJ release: "North Korea's FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user. It exploits our trust in ubiquitous video conference platforms and valued personal relationships."
The Binance Hack and What's Still Missing
The simultaneous Binance action concerns the October 29 hack, which the FBI attributes to TraderTraitor, the same North Korean military unit responsible for the roughly $1.5 billion Bybit hack in 2025. The DOJ's floor figure for the Binance theft is more than $6 billion. The court seizure order covers $1.2 billion of that. A broader public-private freeze has locked more than $2.7 billion in total, per the DOJ press release.
The math here is not encouraging. At $2.7 billion frozen against $6 billion-plus stolen, more than half of the funds from one hack remain at large, and are presumed to be moving through DeFi bridges and instant-swap services per FBI advisory. Principal Deputy Attorney General M. Scott Proctor framed the stakes directly: "North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft."
North Korea has denied involvement in both operations.
The Attack Surface Is the Custodian
Neither FaceStealer nor TraderTraitor broke Bitcoin's protocol. They broke the people who hold keys on other people's behalf. The $400 million FaceStealer took came from operators, developers, and custodians who could be manipulated on a video call. Cumulative hack losses since 2017 make the pattern clear: centralized custody is the recurring point of failure.
The 900 seized webcam recordings underscore something the dollar figures alone obscure. North Korea spent 18 months building a dossier on the crypto industry's operational layer: who works where, what their faces look like, and whose voice a target trusts enough to follow instructions. That intelligence persists long after the seized infrastructure goes dark.
The thesis that custodial platforms are the structural attack surface holds as long as nation-state actors continue to demonstrate that social engineering a human intermediary is a more efficient path to funds than attacking the underlying cryptography. That thesis weakens only if regulated custodians can demonstrate zero losses to this class of attack while holding billions in customer funds, or if a verifiable FaceStealer-class operation is shown to have systematically drained air-gapped, self-custied Bitcoin at scale. Neither condition exists today.
What to Watch
The DOJ has court orders on $1.2 billion. Over $3 billion from the Binance hack remains unaccounted for and in active laundering.
Watch for follow-on actions targeting DeFi front-ends and instant-swap services used in the laundering chain, and whether coordinated freezes get extended across other chains. That will tell you a lot about how far this public-private cooperation actually extends.
Sources
Frequently Asked Questions
What is FaceStealer and how does the attack work?
FaceStealer is a North Korean social-engineering campaign attributed by the FBI to the hacking cluster known in the private sector as Sapphire Sleet, UNC1069, Stardust Chollima, APT38, and BlueNoroff. Attackers compromise an account belonging to a prior victim, use it to invite a new target to a video call, then play pre-recorded footage or AI deepfake video of a trusted contact during the call. Once trust is established, the target is induced to install malware that steals private keys and wallet credentials.
Is Bitcoin held in self-custody vulnerable to this attack?
FaceStealer targets custodians, operators, and developers who hold or have access to keys on behalf of others. An air-gapped hardware wallet with keys that never touch an internet-connected device is not vulnerable to this vector. The attack requires social engineering a human who has network access to funds. The threat to a self-custody holder would need to come through physical coercion or seed backup compromise, not a fake video call.
How much of the Binance hack money has been recovered?
The DOJ's court seizure order covers more than $1.2 billion. A broader freeze achieved through public-private cooperation covers more than $2.7 billion of the $6 billion-plus stolen in the October 29 hack. The remainder, more than half the total, is believed to be in active laundering through DeFi protocols and instant-swap services per FBI guidance.
