DOJ Seizes 'FaceStealer' Infrastructure as North Korean Hackers Take $400 Million

North Korean hackers stole more than $400 million in cryptocurrency over the past 18 months through an AI-deepfake video-call scheme the FBI calls “FaceStealer,” the U.S. Justice Department said Thursday as it announced the seizure of the operation’s infrastructure.

The scheme turns video conference calls into an attack vector. Hackers lure targets into meetings using accounts stolen from previous victims, then play prerecorded webcam footage of trusted contacts to simulate their presence, according to the DOJ. The group also generates deepfake videos of well-known figures in the crypto industry and adjacent sectors to make the ruse more convincing.

The FBI said it seized more than 900 webcam recordings of FaceStealer victims under a federal warrant. That figure measures the scale of surveillance behind the operation: victims were being recorded and reused as props in later attacks against their own contacts.

How does the attack actually work?

Once a target relaxes, the attackers manufacture a fake technical glitch — claiming, for example, that the person cannot be heard — and offer a link to “fix” it. The link installs malware instead.

From there, the hackers can drain crypto wallets or exploit the victim’s access to wider systems. The DOJ said attackers sometimes wait months, or more than a year, before striking, which complicates incident response and attribution.

Who is behind it, and who is at risk?

The DOJ tied the operation to North Korean groups tracked as Sapphire Sleet, BlueNoroff and APT38, among other names. The department warned that the hackers have increasingly targeted open-source software developers, apparently to enable supply-chain attacks — a shift that extends the blast radius from individual wallets to entire codebases and their downstream users.

The announcement paired the FaceStealer seizure with an update on the record-breaking Binance hack. The DOJ said it has obtained court authorization to seize or restrain more than $1.2 billion of the roughly $6.4 billion stolen from the exchange on Oct. 29, part of over $2.7 billion frozen so far.

The FBI attributed the Binance theft to the North Korean group TraderTraitor. According to the bureau, the regime has been laundering the proceeds at speed, spinning up a new wallet roughly every 25 seconds — a tempo that outpaces most conventional tracing workflows.

North Korea has denied involvement and called the FBI’s finding a political provocation.

What does this say about Pyongyang’s crypto operations?

The actions underscore how central cryptocurrency theft has become to Pyongyang’s finances. The U.S. recently sanctioned 11 people over a North Korean IT-worker scheme that moved millions in crypto, and researchers have cataloged the many techniques the regime’s hackers use to breach crypto firms.

For crypto firms, the operational consequences are direct. Video-call verification is no longer sufficient proof of identity, and developers with commit access now sit in the primary target set. Firms that rely on known contacts appearing on camera — a standard due-diligence shortcut — face an adversary that can fabricate that signal on demand.

Officials said efforts to trace and recover the stolen Binance funds are ongoing, and additional restraint orders remain likely as investigators follow the roughly $3.7 billion not yet under seizure authorization.