In brief
- The DOJ said North Korean hackers stole more than $400 million in crypto over 18 months via “FaceStealer,” a scheme using secretly recorded webcam footage and AI deepfakes of trusted figures to win targets trust on video calls.
- The hackers increasingly target open-source developers, apparently to enable supply-chain attacks.
- Separately, the DOJ has obtained authorization to seize over $1.2 billion tied to the Binance hack, part of $2.7 billion frozen.
North Korean hackers have stolen more than $400 million in cryptocurrency over the past 18 months using a social-engineering scheme built on secretly recorded footage and AI deepfakes, the U.S. Justice Department said Thursday, as it announced the seizure of the infrastructure behind the operation.
The scheme, which the FBI calls “FaceStealer,” turns video conference calls into a trap. According to the DOJ, hackers lure targets into meetings using accounts stolen from previous victims, then play prerecorded webcam footage of trusted contacts to simulate their presence and win the targets confidence.
The group also generates deepfake videos of well-known figures in the crypto and related industries, using AI to make the ruse more convincing.
Predict·CryptoBTC price on November 15, 4:59PM UTC
Above 70,00078%YesNo
Above 72,00044%YesNo
Above 74,00012%YesNo
Above 76,0002%YesNo
Above 78,0001%YesNo
+1 more outcomes
NEW
$0.26 volume
Nov 15Closes: Nov 15, 2026, 16:59 UTC
Closes: Nov 15, 2026, 16:59 UTC
Once a target is at ease, the attackers manufacture a fake technical glitch, such as claiming the person cant be heard, and offer a link to “fix” it, which instead installs malware.
From there, the hackers can drain crypto wallets or exploit the victims access to other systems, sometimes waiting months or more than a year before striking. The FBI said it seized over 900 webcam recordings of FaceStealer victims under a federal warrant.
The DOJ tied the operation to North Korean groups known variously as Sapphire Sleet, BlueNoroff and APT38, among others, and warned the hackers have increasingly targeted open-source software developers in an apparent bid to enable supply-chain attacks.
BitcoinBTC · USD
$71,508−5.56%
24H7D1M1YYTD
Nov 5Nov 7Nov 9Nov 11Nov 12
$76.3k$74.7k$73.1k$71.4k
24h HighHigh$74,469
24h LowLow$71,238
VolVol$1.1B
Market projectionsOdds by Myriad
TodayBelow $72,000Below $72k64% chanceThis weekBelow $72,000Below $72k56% chance
→
Buy Bitcoin with USDC
Powered by Jupiter
$50$100$500
Buy
Price data by CoinGeckoCoinGeckoMore Bitcoin news and projections →
The announcement came paired with an update on the record-breaking Binance hack. The department said it has now obtained court authorization to seize or restrain more than $1.2 billion of the roughly $6.4 billion stolen from the exchange on Oct. 29, part of over $2.7 billion frozen so far.
The FBI attributed that theft to the North Korean group TraderTraitor, and the regime has been laundering the proceeds at speed, spinning up a new wallet roughly every 25 seconds. North Korea has denied involvement, calling the FBIs finding a political provocation.
The actions underscore how central crypto theft has become to Pyongyang‘s finances. The U.S. recently sanctioned 11 people over a North Korean IT-worker scheme that moved millions in crypto, and researchers have cataloged the many ways the regime’s hackers break into crypto firms.
Officials said efforts to trace and recover the stolen Binance funds are ongoing.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Email addressJoin free
Join 72,000+ readers
Create an account to save your articles.
Add on Google
Add Decrypt as your preferred source to see more of our stories on Google.