Justice Department Announces Actions to Disrupt North Korea’s…

MENU News

Archived Press Releases

Press Release Justice Department Announces Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency Thursday, November 12, 2026 Share

For Immediate Release Office of Public Affairs North Korean Super Intelligence-Enabled Social Engineering Campaign Known as “FaceStealer” Targeted Cryptocurrency Holders and Individuals Working the Open-Source Supply Chain

Today the Department of Justice announced coordinated actions against the Democratic People’s Republic of North Korea (DPRK) government’s schemes to fund its regime through the massive theft of cryptocurrency. These actions include the seizure of cloud-based infrastructure used in the FaceStealer social engineering scheme that has resulted in the theft of more than $400 million worth of cryptocurrency and the court-authorized seizure and restraint of more than $1.2 billion worth of cryptocurrency recently stolen from Binance, a virtual currency exchange.

“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said Principal Deputy Assistant Attorney General for National Security M. Scott Proctor. “Today’s announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime. The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.”

“The Criminal Division, specifically the Computer Crime and Intellectual Property Section (CCIPS), and our law enforcement partners played the critical role in immediately freezing billions of dollars’ worth of stolen Binance digital assets before they got beyond law enforcement reach,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “As the Department’s liaison to the digital asset industry, the Criminal Division quickly and efficiently used its expertise to immediately halt about half of this historic breach.”

“Cryptocurrency unfortunately has become fertile ground for North Korea to defraud victims and fund its malign activities,” said First Assistant U.S. Attorney Bill Essayli for the Central District of California. “Today’s seizure shows that America will continue the fight against rogue states who financially gain from cybercrime.”

“By springing into action at a moment’s notice, we worked together to freeze this massive criminal fraud in its tracks,” said U.S. Attorney Jeanine Ferris Pirro for the District of Columbia. “The North Korean regime may think they are sophisticated cyber criminals, but we have consistently met them head on, as we did here seizing more than $1.2 billion of their stolen assets.”

“The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years,” said FBI Cyber Branch Operations Director Brett Leatherman. “North Korean cyber actors have used the FaceStealer scheme to aggressively target individuals in the cryptocurrency and Web3 sectors through deceptive social engineering tactics, resulting in the theft of more than $400 million in the last 18 months. The FBI remains committed to identifying, disrupting, and imposing cost on North Korean actors targeting the virtual asset community.”

“North Korea’s FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user” said Assistant Director in Charge Patrick Grandy of the FBI’s Los Angeles Field Office. “It exploits our trust in ubiquitous video conference platforms and valued personal relationships. If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough. The FBI is sounding the alarm to elevate awareness of this growing scheme, now aimed not only at crypto theft, but also the exploitation of the of the open-source software supply chain.”

Seizure of FaceStealer Infrastructure – Central District of California

Today, the U.S. Attorney’s Office for the Central District of California announced the disruption of cloud-based infrastructure used by North Korean hackers in a highly effective social engineering scheme that the FBI is calling “FaceStealer.” The scheme, which relies on surreptitiously recorded videos and artificial deepfakes, has resulted in the theft of more than $400 million in the last 18 months and the attempted compromise of individuals involved in the open-source software supply chain.

North Korean hackers known publicly by the names Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, Advanced Persistent Threat 38 (APT38), BlueNoroff, and Stardust Chollima have lured targets with invitations to video meetings delivered from accounts stolen from prior victims. Once a target joins the meeting, the hackers record the target’s webcam video and play a prerecorded video of a previous victim or victims known to the target, thereby simulating the participation of trusted contacts in the meeting to gain the target’s trust. The North Korean hackers also use super intelligence (SI) to develop deepfake videos of well-known and influential individuals often in the cryptocurrency and web3 industries that make the FaceStealer scheme even more effective. Here again, they use the deepfake videos in the meetings with targets to gain the target’s trust.

During the meeting, the hackers then introduce a fake technical error into the meeting, such as claiming that the target cannot be heard, and provide a link or prompt to fix the error. The “fix” surreptitiously installs malware on the target’s computer. With the target’s computer compromised, the hackers can steal cryptocurrency or exploit the target’s access to other computer infrastructure. In several reported cases, the hackers stole cryptocurrency and hijacked communication accounts several months to more than a year after the initial compromise. As part of the scheme the hackers also accessed the new victim’s contact lists, social media, and communications apps to target the victim’s personal and professional contacts.

The North Korean hackers target individuals working in the cryptocurrency and web3 industries. Additionally, they have increasingly targeted individuals involved in the development and maintenance of open-source software with the FaceStealer technique, attempting to gain access to their devices and the software repository accounts they control. This targeting appears calculated to enable software supply-chain attacks. Pursuant to a federal warrant, the FBI seized over 900 webcam videos of FaceStealer victims.

The FBI today published a report providing greater detail on the mechanics of the FaceStealer scheme, including best practices to protect against this scheme and steps victims can take in the event of a compromise. Additionally, the FBI created a website, www.fbi.gov/facestealer, to serve as a centralized hub for resources and information on the scheme.

The effort to disrupt the FaceStealer campaign was led by Assistant U.S. Attorney Khaldoun Shobaki for the Central District of California and the FBI’s Los Angeles Field Office.

The Department, FBI, and Law Enforcement Partners Interdict More Than a Billion Dollars Worth of Virtual Assets Stolen From Binance

Separately from the FaceStealer campaign, on or about Oct. 29, members of the North Korean military, referred to by the FBI as “TraderTraitor” stole more than $6 billion worth of virtual assets from the Binance cryptocurrency exchange. Since the theft, the National Security Division’s National Security Cyber Section, the Criminal Division’s Computer Crime and Intellectual Property Section, the U.S. Attorney’s Office for the District of Columbia, and law enforcement partners have worked closely with virtual asset service providers (VASPs) to interdict the stolen assets. Collective U.S. government and private sector efforts so far have resulted in the freeze of more than $2.7 billion, with the Department having already obtained court-authorization to seize or restrain in excess of $1.2 billion of that amount.

Efforts to trace, freeze, seize, and forfeit the stolen virtual assets are ongoing, as TraderTraitor actors continue to launder such assets through various cryptocurrency bridges, mixers, and exchanges. For example, last week, the FBI, in coordination with its law enforcement partners at the U.S. Secret Service (USSS) and the Internal Revenue Service (IRS-CI), issued a Cyber Alert attributing the theft and urging VASPs to block transactions with or derived from cryptocurrency addresses TraderTraitor actors are using to launder the stolen Binance assets.

The FBI’s Los Angeles Field Office, Cyber Division, and Virtual Asset Unit are coordinating the FBI’s efforts to recover the stolen virtual assets, working in partnership with the USSS and the IRS-CI.

Updated November 12, 2026 Topics Cybercrime National Security Components Criminal - Computer Crime and Intellectual Property Section Federal Bureau of Investigation (FBI) National Security Division (NSD) USAO - California, Central USAO - District of Columbia Press Release Number: 26-1356

Justice Department Announces Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency

MENU News

Archived Press Releases

Related Content