DOJ Disrupts FaceStealer, North Korean Scheme Behind $400 Million

The U.S. Justice Department said Thursday it disrupted cloud infrastructure used in a North Korean crypto-theft scheme that stole more than $400 million in digital assets over 18 months. The FBI, which calls the operation FaceStealer, seized more than 900 webcam videos under a federal warrant as part of the disruption.

The scale is considerable. A loss of $400 million over 18 months averages roughly $22 million per month — a sustained drain on crypto-sector personnel and firms rather than a single exploit.

How does the scheme actually work?

According to the FBI, the attackers took over accounts belonging to targets' contacts and used them to invite cryptocurrency workers to fake Zoom or Microsoft Teams meetings. Once inside, they played recordings of trusted people and staged technical problems to persuade targets to install malware.

The mechanics matter for practitioners. The initial contact arrives through a compromised account of a known colleague, which defeats the most common heuristic — verify the sender — before the conversation starts. The meeting itself is the delivery vector: the staged malfunction pushes the target toward installing what appears to be a fix.

The FBI notes that AI-generated deepfakes of prominent crypto and Web3 figures have also appeared in these operations. Stolen recordings of real people, however, remain the scheme's dominant method. The bureau's seizure of more than 900 webcam videos reflects that preference — a stockpile of authentic footage, not synthetic substitutes. The FBI cautions that the 900 figure counts videos, not a confirmed number of victims.

What does this change for developers?

The FBI says FaceStealer actors have increasingly targeted open-source developers, apparently to gain access to software repositories. That shift widens the attack surface from individuals holding funds or signing keys to the maintainers of code that other teams depend on.

For engineering leads, the operational consequence is direct: repository access is now a monetizable compromise target for state-sponsored actors. Treating a meeting invitation from a colleague's account as unauthenticated — verifying out-of-band before installing anything — becomes baseline hygiene.

A separate, larger seizure is running in parallel

The FaceStealer disruption is not the only North Korean-linked action in motion. Government and private-sector efforts had frozen more than $2.7 billion tied to a Binance theft on or about Oct. 29, a case involving more than $6 billion in virtual assets. Courts have authorized seizure or restraint of more than $1.2 billion of those funds.

The FBI attributes the Binance theft to TraderTraitor, a separate North Korean operation distinct from FaceStealer. The two threads together describe a landscape in which U.S. authorities are pursuing multiple Democratic People's Republic of Korea-linked theft programs simultaneously, with recovery and restraint proceedings advancing on different timelines.

Where this goes next

With more than $1.2 billion already subject to court-authorized seizure or restraint in the Binance matter and the FaceStealer infrastructure now dismantled, the enforcement window has shifted from disruption toward recovery — expect forfeiture filings and further warrants as investigators work through the seized video evidence.