The US Department of Justice announced coordinated measures against North Korea's crypto-crime schemes. They include dismantling the infrastructure of the FaceStealer social engineering campaign and seizing funds stolen from the Binance cryptocurrency exchange.
According to the agency, FaceStealer allowed North Korean hackers to steal more than $400 million over the past 18 months. At the same time, in a separate operation, law enforcement officers and private sector representatives froze more than $2.7 billion in assets stolen from Binance. Of this sum, the court authorized the seizure or blocking of more than $1.2 billion.
How does the FaceStealer scheme work?
According to the U.S. Department of Justice, the FaceStealer campaign uses social engineering, recorded videos, and deepfakes to gain access to victims' devices.
Hackers linked to North Korea are sending invitations to video meetings from accounts stolen from previous victims. After the user connects, the attackers record video from their webcam and play pre-prepared recordings of other people familiar with the target. This creates the impression that trusted
Also, the attackers use artificial intelligence to create deepfakes of famous people, in particular representatives of the cryptocurrency and Web3 industries.
During the meeting, the hackers simulate technical problems, for example claiming they cannot hear the interlocutor. Then they send a link or instructions to fix the malfunction. Following these actions covertly installs malicious software on the victim's device.
Having gained access to the computer, attackers can steal cryptocurrency or use it to penetrate other infrastructure. In some cases, theft of funds and hacking of communication accounts occurred several months or even more than a year after the initial compromise.
In addition to cryptocurrency owners, hackers are increasingly attacking developers and maintainers of open-source software. Their goal is access to devices and accounts in repositories, which can create opportunities for software supply chain attacks.
As part of an FBI investigation, more than 900 recordings from the webcams of FaceStealer victims were seized.
The US intercepted part of the funds stolen from Binance
Separately, the US Department of Justice announced measures regarding assets stolen from Binance. According to the FBI, the attack was carried out by North Korean hackers known as TraderTraitor. They stole virtual assets worth more than $6 billion.
Binance suffered the largest hack in crypto market history — losses estimated at $6.3 billion
30.10.2026
Read
How hackers withdrew $2.5 billion from a single Binance wallet — Blockaid revealed the attack mechanism
30.10.2026
Read
After the incident, U.S. law enforcement agencies began cooperating with virtual asset service providers (VASPs) to track and block the stolen funds. Joint actions by government agencies and the private sector made it possible to freeze more than $2.7 billion.
The Ministry of Justice has already received court permission to seize or block more than $1.2 billion from these assets. At the same time, work on tracking and confiscating the funds continues: according to the ministry, the perpetrators continue to launder them through cryptocurrency bridges, mixers, and exchanges.
Last week, the FBI, together with the U.S. Secret Service and the U.S. Internal Revenue Service Criminal Investigation Division, published a warning about the activities of TraderTraitor. In it, the agency called on cryptocurrency service providers to block transactions associated with addresses that the group uses to launder stolen Binance assets.
The US Department of Justice stated that it will continue to use legal and technical tools to seize and return assets obtained by North Korea as a result of cybercrimes.
Recall that we previously reported that hackers from the DPRK used memecoins to launder funds after the Binance hack.