DOJ Seizes Infrastructure Behind $400 Million FaceStealer Campaign

The U.S. Department of Justice has seized cloud infrastructure tied to FaceStealer, a North Korea-linked operation responsible for more than $400 million in cryptocurrency thefts over 18 months. The DOJ carried out the seizure jointly with the FBI, according to the department's announcement.

The scheme worked through deception. FaceStealer lured targets into fraudulent video meetings, then used social engineering — tricks designed to win a victim's trust — during those calls to compromise them. Investigators recovered more than 900 video files showing victims, recorded without their knowledge during the fake sessions.

The targets were not random. The operation focused largely on people working in crypto and Web3, along with maintainers of open-source software — the developers whose accounts, if compromised, can open doors to entire projects and supply chains.

Who is behind FaceStealer?

The DOJ attributed the campaign to five hacking groups associated with North Korea: Sapphire Sleet, UNC1069, Stardust Chollima, APT38 and BlueNoroff. Several of those names have long track records of targeting financial institutions and cryptocurrency businesses. Their tooling now included a simple but effective prop: a video call that never was what it appeared to be.

The operational consequence is significant. By taking possession of the cloud infrastructure, the DOJ and FBI have disrupted the technical backbone the groups used to run their fraudulent meetings. Investigators also now hold hundreds of recordings that could support victim notification, attribution work and future prosecutions.

What is the $1.2 billion freeze?

The DOJ separately placed more than $1.2 billion in digital assets tied to North Korean actors and the Binance theft under freeze. That action concerns a different incident. The $400 million figure applies strictly to FaceStealer's theft total across its 18-month run. The two matters share a common thread — North Korean cyber operations funding state priorities — but they are distinct enforcement actions.

For crypto and Web3 firms, the practical takeaway is blunt. The attack surface here was not a smart contract or a private key management flaw. It was a calendar invitation and a video conference. Employees who handle treasury functions, deploy code or administer infrastructure remain the highest-value targets, and fake meeting software is now a standard weapon against them.

What does this change for security teams? It raises the bar on verifying who is actually on the other end of a call, especially when a recruiter, investor or unknown collaborator requests screen sharing or a software install during a meeting. The FBI's involvement suggests the bureau will keep treating North Korean crypto theft as a priority threat, not a niche concern.

The enforcement window is open. With the infrastructure seized and hundreds of recordings in investigators' hands, follow-on charges against named individuals — and further freezes of linked wallets — are the logical next steps for prosecutors building cases from this disruption.