U.S. Justice Department seizes $400M FaceStealer infrastructure

The U.S. Justice Department seized more than 900 secretly recorded webcam videos from victims of FaceStealer, a North Korea-linked cryptocurrency-theft operation that took more than $400 million over 18 months, according to the agency.

In a parallel action, the DOJ froze more than $1.2 billion in digital assets linked to North Korean actors and to a theft from Binance. The agency attributed that theft to North Korean groups on October 29, 2026, when it put the total stolen at more than $6 billion.

The operation targeted several state-sponsored hacking groups linked to North Korea that investigators track as:

• Sapphire Sleet
• UNC1069
• Stardust Chollima
• APT38
• BlueNoroff

The agency linked the recorded videos to fraudulent video-conferencing sessions used in the scheme.

What do the dollar figures cover?

The figures cover distinct theft totals and enforcement measures, so they should not be added together as a single loss estimate.

• More than $400 million: FaceStealer thefts linked to the video-call scheme over 18 months.
• More than $6 billion: Total stolen in the Binance theft that DOJ attributed to North Korean groups on October 29, 2026.
• More than $1.2 billion: Digital assets frozen in the latest action, linked to North Korean actors and the Binance theft.
• Estimated $2.8 billion: Assets frozen in the earlier stage.

The $400 million FaceStealer figure excludes the Binance incident. The reported freeze stages amount to roughly $4 billion, although the first stage remains an estimate. FaceStealer’s $400 million over 18 months equates to roughly $22 million a month, while the Binance theft exceeds the FaceStealer total by about 15 times.

Why did the video-call scheme work?

FaceStealer did not need to break any cryptography. The agency describes an attack that depended on people trusting what they saw during a video call. More than 900 recordings each preserve at least one moment when a participant believed they were joining an ordinary meeting.

Most victims worked in crypto and Web3, while investigators also identified open-source software maintainers among the targets. The target set therefore reaches beyond crypto-native employers. For security teams, the operational lesson is that a video call requires identity verification independent of the displayed face, because the scheme exploited trust without attacking encryption.

What does this change for crypto and Web3 teams?

First, the video seizure gives investigators material recorded in more than 900 sessions, including footage of the deceptive calls used in the thefts. That can support victim identification and analysis of the operation’s social-engineering methods, although the DOJ account provides no recovery timetable or technical breakdown of the seized material.

Second, the freeze changes how affected digital assets must be handled. More than $1.2 billion remains unavailable for ordinary settlement, and compliance teams must distinguish frozen property from assets available for normal transfers. For firms running treasury, custody or settlement workflows, the practical task is reconciling visible balances against restriction records rather than assuming every balance supports a transfer.

The prevention lesson is narrow but practical: a video call cannot serve as sufficient authentication for a financial instruction, even when the face and meeting context appear genuine. Security controls must therefore address identity, not only encryption.

The next measure is whether the latest $1.2 billion freeze and the seized recordings translate into sustained disruption of the five tracked groups; the DOJ account sets no deadline, leaving the enforcement effort in an open phase rather than a completed shutdown.