Key Takeaways
- The US Justice Department said on November 12, 2026, that it had court authorization to seize or restrain more than $1.2 billion of the cryptocurrency stolen from Binance on or about October 29, 2026.
- Government and private sector efforts have frozen more than $2.7 billion of the stolen Binance funds, and the Justice Department's $1.2 billion is part of that total, not an additional recovery, according to the Justice Department and Nextgov/FCW.
- The FBI said North Korea's FaceStealer scheme, which uses fake Zoom and Teams meetings with recorded video of victims' contacts, has stolen more than $400 million in cryptocurrency in the last 18 months.
- Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims, and the Justice Department said it seized cloud infrastructure used in the scheme.
What happened
The US Department of Justice announced on November 12, 2026, what it called coordinated actions against North Korea's theft of cryptocurrency. They include the court-authorized seizure and restraint of more than $1.2 billion in cryptocurrency stolen from the exchange Binance, and the seizure of cloud infrastructure used in a social engineering scheme, one that tricks people into giving access, that the FBI calls FaceStealer, according to a Justice Department press release.
The two cases are separate. Officials said the two campaigns likely involved different North Korean actors, Nextgov/FCW reported. An FBI agent told The Record that it is unclear whether FaceStealer was one of the methods used to breach Binance.
The Binance funds
The Justice Department said that on or about October 29, members of the North Korean military, referred to by the FBI as TraderTraitor, stole more than $6 billion in virtual assets from Binance. Nextgov/FCW and The Record put the theft at about $6.3 billion.
Combined US government and private sector efforts have frozen more than $2.7 billion so far, the department said, and it has court authorization to seize or restrain more than $1.2 billion of that amount. Nextgov/FCW reported that the $1.2 billion is part of the $2.7 billion and not an additional recovery.
A senior Justice Department official said the government now has custody of the funds covered by the court orders, according to Nextgov/FCW. Returning them would generally involve court proceedings to determine ownership, though the official said it was too early to say how that would unfold.
The department said efforts to trace, freeze, seize, and forfeit the stolen assets are ongoing, as TraderTraitor actors continue to launder them through cryptocurrency bridges, mixers, and exchanges. The senior official told Nextgov/FCW that recovery is getting harder as the hackers split the money into smaller amounts across laundering networks. Blockchain analytics firm Elliptic said North Korea's launderers were creating their own worthless tokens to move the stolen assets through decentralized exchanges, The Record reported.
How FaceStealer works
The FBI attributes FaceStealer to the North Korean group known in the private sector as Sapphire Sleet, UNC1069, Stardust Chollima, APT38, and BlueNoroff, according to its FaceStealer page. The Justice Department said the scheme has resulted in the theft of more than $400 million in the last 18 months.
According to the Justice Department, the hackers invite targets to video meetings from accounts stolen from earlier victims. During the meeting they record the target's webcam and play a prerecorded video of a previous victim the target knows, so the call appears to include trusted contacts. The department said the hackers also use deepfake videos, fake videos made with AI, of well-known people in the cryptocurrency industry.
The hackers then claim a technical problem, such as the target not being heard, and offer a fix that secretly installs malware, the department said. With the computer compromised, they can steal cryptocurrency or use the victim's access to other systems. The hackers go on to use the stolen accounts and recordings to target the victim's own contacts, The Record and Nextgov/FCW reported.
The FBI said the group increasingly targets developers and maintainers of open-source software, with the aim of compromising the software supply chain. The FBI also said hackers broke into the computer of a developer who maintains widely used software and added malicious code, which was detected and stopped before it spread widely, Nextgov/FCW reported. Arctic Wolf, a firm that helped the FBI track the operation, said it has identified more than 677 targets across 58 countries, according to Nextgov/FCW.
Response and advice
Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims, the Justice Department said. FBI officials said they have contacted many of the victims, The Record reported.
"This is not something we can patch," Jeremy Robertson, special agent in charge at the FBI's Los Angeles field office, told reporters, according to Nextgov/FCW.
The FBI published a report on the scheme with best practices to protect against it and steps victims can take after a compromise, and created a resource page at fbi.gov/facestealer, the Justice Department said. The FBI, the Secret Service, and IRS Criminal Investigation earlier issued an alert urging virtual asset service providers to block transactions with or derived from addresses TraderTraitor is using to launder the stolen Binance assets, according to the department.