DOJ Seizes Infrastructure Behind $400M North Korean Fake-Call Thefts

The U.S. Justice Department said Thursday it has seized cloud infrastructure used in a North Korean video-call impersonation campaign that stole more than $400 million in cryptocurrency over the past 18 months. The disruption, announced Nov. 12, targets an operation the FBI calls FaceStealer, and it arrives alongside a separate court authorization to seize or restrain more than $1.2 billion in assets tied to a $6 billion theft from Binance.

The mechanics matter for every firm that relies on video conferencing. FaceStealer operators use accounts stolen from earlier victims to invite their contacts to meetings, according to the DOJ. During the call, attackers play secretly recorded webcam footage of people the target knows, or deepfake videos of prominent crypto figures, to make the meeting appear genuine.

"It exploits our trust in ubiquitous video conference platforms and valued personal relationships," said Patrick Grandy, assistant director in charge of the FBI's Los Angeles Field Office, in the announcement.

How the infection works

Once the target is on the call, attackers claim a technical problem — typically that the target's audio is not working — and supply a link or prompt to fix it. That supposed fix installs malware on the target's machine, the DOJ said. The FBI's FaceStealer resource page documents realistic imposter versions of legitimate video-conferencing platforms built for this purpose.

Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims. Attackers harvest victims' contact lists and communications accounts to approach the next wave of targets, which explains the campaign's persistence: in several reported cases, crypto theft and account hijacking occurred months to more than a year after the initial compromise.

What does this change for practitioners?

The exposure extends well beyond an individual's crypto holdings. The DOJ said attackers exploit a compromised user's access to broader computer infrastructure and increasingly target open-source developers and maintainers to gain access to software repository accounts. That targeting appears intended to enable software supply-chain attacks, potentially reaching users of the affected software, according to the FBI.

For security teams, this reframes the threat from direct wallet theft to supply-chain contamination. A single compromised maintainer account can propagate downstream to every dependent project. The $400 million figure — roughly $22 million per month across 18 months — represents only the directly observed crypto losses, not the latent supply-chain exposure the FBI is now flagging.

The video-call lure builds on a pattern the FBI warned about in September 2024, when it flagged requests to run scripts to enable calls as a potential indicator of North Korean social engineering. DeFi employees were among the targets at the time. That advisory recommended verifying contacts through separate, unconnected communication platforms and restricting which files company devices can download or execute.

A separate $6 billion Binance case

In the same announcement, the DOJ said it obtained court authorization to seize or restrain more than $1.2 billion in assets tied to a separate Binance theft. The FBI attributed that theft of more than $6 billion, occurring on or about Oct. 29, to North Korean activity it calls TraderTraitor. The DOJ explicitly distinguished TraderTraitor from FaceStealer.

The $1.2 billion authorization is part of more than $2.7 billion already frozen through combined government and private-sector efforts — not an additional recovery on top of it. To put the scale in context: $6 billion is roughly triple the largest exploit ever recorded in DeFi history.

Efforts to trace, freeze, seize and forfeit the Binance assets remain ongoing, the DOJ said, as the attackers continue to launder funds through bridges, mixers and exchanges. Tracing and forfeiture windows will tighten as funds fragment across those channels, which makes the coming weeks decisive for how much of the frozen $2.7 billion ultimately converts into recovered assets.