DOJ Dismantles FaceStealer Infrastructure Behind $400 Million Crypto Theft

The Department of Justice said Thursday it has dismantled the cloud infrastructure behind FaceStealer, a North Korean social-engineering scheme that stole more than $400 million in cryptocurrency over 18 months. The FBI, under a federal warrant, seized more than 900 secretly recorded webcam videos of the scheme's victims.

The operation targeted people working in crypto and web3. According to the DOJ, hackers used accounts stolen from previous victims to invite new targets to video calls, then played back prerecorded webcam footage of people those targets personally knew — manufacturing the presence of a trusted colleague on the line. That is roughly $22 million stolen per month, sustained for a year and a half.

How did the fake video calls work?

The DOJ described a repeatable sequence. When a target joined a call, the hackers recorded that person's own webcam while playing prerecorded footage of a known contact. The crews also produced deepfake videos of influential figures in crypto and web3, using what the department called "super intelligence," and ran those recordings inside the same meetings.

Partway through the call, a fabricated technical fault would appear — for instance, the target could not be heard. A link or prompt to "fix" the problem then silently installed malware. Once the machine was compromised, the hackers could steal cryptocurrency directly or exploit the target's access to other systems.

The thefts were not always immediate. In some cases, account takeovers and thefts occurred months to more than a year after the initial intrusion — a dwell-time window that complicates attribution and recovery for victims.

The scheme was self-propagating. Hackers combed through each new victim's contact lists, social media and messaging apps, turning discovered personal and professional contacts into the next round of targets.

"It exploits our trust in ubiquitous video conference platforms and valued personal relationships," said Patrick Grandy, assistant director in charge of the FBI's Los Angeles Field Office. "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."

In short: the attack surface is ordinary workplace trust, not a protocol vulnerability.

Who is behind FaceStealer?

The DOJ linked FaceStealer to North Korean groups tracked under multiple names: Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. The name sprawl reflects parallel tracking by different security vendors rather than separate operations.

One shift deserves attention. Open-source software developers face growing targeting, with attackers going after their devices and code repository accounts. The DOJ said this appears designed to enable supply-chain attacks — meaning a single compromised maintainer could affect every downstream user of their code. The department did not quantify how many repositories have been affected.

The FBI has published a report explaining how the scheme works, including protective steps and guidance for victims, and launched a FaceStealer website as a resource hub.

What happened with the $1.2 billion Binance restraint?

The Justice Department paired the FaceStealer seizure with a separate enforcement action. It won court approval to seize or restrain more than $1.2 billion stolen from Binance, part of more than $2.7 billion frozen so far — a figure approaching the annual budget of several small national cybersecurity agencies.

The department attributed the theft to North Korean military hackers it calls TraderTraitor, who it says siphoned more than $6 billion from the exchange around October 29. That would make it one of the largest single exchange losses on record. North Korea has denied any involvement.

"North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," said M. Scott Proctor, Principal Deputy Assistant Attorney General for National Security.

Denial aside, the laundering continues. The DOJ said TraderTraitor is still moving the Binance funds through cross-chain bridges, mixers and exchanges, and that efforts to trace, freeze, seize and forfeit the assets are ongoing.

The immediate operational takeaway for crypto firms is procedural: verify identities out-of-band before installing any software suggested during a call, and treat audio-failure prompts on video meetings as a red flag rather than a nuisance.