FBI attributes more than $400 million in cryptocurrency thefts to North Korean hackers

The FBI attributes more than $400 million in cryptocurrency thefts over the past 18 months to North Korean hackers running FaceStealer, a social-engineering operation that targets cryptocurrency-industry employees through fake video-conference calls.

The scheme starts with a fake video call built around an apparent familiar contact. When the target complains of audio trouble, the attackers offer a fix that delivers malware instead: software that records keystrokes, captures screens, grants continued access and secretly records the target’s webcam. A follow-up trick tells victims to run scripts or paste terminal commands that install the malware rather than repair audio. Authorities seized cloud infrastructure and more than 900 webcam videos of FaceStealer victims under a federal warrant.

Invitations to the fake meetings arrive through genuine accounts the hackers have taken over on Telegram, LinkedIn, Slack and Discord, and the links direct targets to sites designed to look like Zoom or Microsoft Teams. From each new victim the hackers extract contact lists along with social media and messaging apps to identify more people to target, and in several reported cases account hijacking or theft arrived months to more than a year after the first infection.

The campaign has moved beyond cryptocurrency holders toward open-source software developers, whom hackers target for access to devices and repository accounts in an apparent attempt to enable supply-chain attacks. Federal prosecutors said the targeting seems designed to let compromised code spread among many downstream users. Detection stopped hackers who broke into a developer of widely used software and added code that could reach downloaders, and in 2026 a JavaScript library maintainer who recognized someone on a fake Teams call had a computer infected through meeting instructions.

Patrick Grandy, the FBI Los Angeles assistant director in charge, said FaceStealer can deceive even experienced users because it exploits trust in video conferencing and personal relationships. First Assistant U.S. Attorney Bill Essayli said North Korea uses cryptocurrency to defraud victims and fund malign activities, calling it fertile ground. M. Scott Proctor said cryptocurrency theft bankrolls North Korea’s government, its rogue regime and its illicit weapons program.

The FBI attributed a roughly $6.3 billion cryptocurrency theft at Binance on or about Oct. 29, 2026, to North Korea’s TraderTraitor group. Officials said the FaceStealer and Binance campaigns likely involved different North Korean actors. Blockchain intelligence firms TRM Labs and Chainalysis had already linked the Binance theft to TraderTraitor before the FBI statement. Elliptic’s analysis puts the Binance haul at $6.43 billion, while Binance’s own estimate is about $6.3 billion.

TraderTraitor is also tracked as Lazarus Group and Jade Sleet and has been linked to the $1.5 billion Bybit heist in February 2025, the $308 million DMM Bitcoin theft in May 2024, the $280 million Drift hack in April 2026 and other crypto thefts. Elliptic believes actors linked to North Korea have stolen more than $6.5 billion in cryptoassets in recent years, including more than $1 billion tracked in 2026 before the Binance hack.

The Justice Department obtained court authorization to seize or restrain over $1.2 billion stolen from Binance. That sum forms part of more than $2.7 billion in frozen funds and does not represent an added recovery. A senior DOJ official said the court orders cover funds the government has custody of, and returning them would require court proceedings to determine ownership. The same official said recovering funds is getting harder because hackers split stolen money into smaller amounts across laundering networks, and authorities said tracing and recovery work continues as hackers shift stolen funds via cryptocurrency bridges, mixers and exchanges.

Binance began restoring withdrawals in phases on Nov. 1, 2026 between 06:00 and 09:00 UTC, and deposits remain open. The company said it has covered approximately 95 percent of the stolen amount, up from 90 percent, and is buying the remaining 5 percent through market and over-the-counter deals, and that it will absorb the financial impact of the stolen funds rather than passing losses to users.

The company set aside more than $6.34 billion of company funds, including SAFU, futures insurance and corporate treasury, and plans to refill SAFU to about $1 billion. Binance said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are fully backed, and it planned to release a complete zero-knowledge proof of reserves by Nov. 3, 2026. Binance co-CEO Richard Teng said its security team found more breach points, pointing to a complex attack involving more than one person.

DOJ said the hackers go by many names, including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. North Korea has denied involvement in the Binance theft, calling the FBI’s finding a political provocation.

The U.S. sanctioned 11 people over a North Korean IT-worker scheme that moved millions in cryptocurrency, and charged 14 people this month over a scheme placing North Korean IT workers at more than 70 companies. Sources disagree on the size of a September 2026 Bitget theft linked to suspected North Korean hackers: BleepingComputer cites $387.5 million while TNW cites $351.6 million. TNW also said North Korean hackers are building their own AI tools.