FBI seizes more than 900 webcam videos in North Korea’s $400 million FaceStealer scheme

This is a new development in a story we reported earlier: FBI attributes more than $400 million in cryptocurrency thefts to North Korean hackers.

On Nov. 12, 2026, the Justice Department and the FBI disrupted FaceStealer, a scheme the FBI tied to North Korea that took more than $400 million in cryptocurrency over 18 months.

Under a federal warrant, federal agents seized more than 900 webcam videos from FaceStealer victims. During fake Zoom and Teams calls, the hackers played prerecorded webcam video of previous victims or people the targets know to draw them in. The FBI said FaceStealer connects to North Korean hackers tracked under names including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, Advanced Persistent Threat 38 (APT38), BlueNoroff and Stardust Chollima.

The attackers scheduled meetings with a Calendly or other calendar invitation. Shortly before the call, a meeting link that looked like Zoom or Teams but pointed to a lookalike domain arrived. The hackers faked an audio or technical problem during the call and then offered a link or prompt meant to fix it. The fix quietly put malware on the target’s computer.

That software included a browser cookie harvester and keyloggers. It also included a screen capturer and a backdoor.

As soon as the person clicked the fake link, the hackers began recording the target’s webcam, turning each new victim into a familiar face for a later call. Once inside a computer, the hackers took cryptocurrency, took over accounts and looked through contact lists, social media and messaging apps to find new victims. In several reported cases, the hackers waited months or more than a year after the first compromise before taking cryptocurrency or seizing communication accounts. The intruders also seized Telegram, LinkedIn, Slack and Discord accounts from earlier victims and used details from old chats to message those victims’ contacts.

They reached out using both newly created and stolen messaging accounts.

Sometimes the hackers let wallet balances increase before taking the funds. Open-source software creators and maintainers are increasingly targeted because they control devices and software repository accounts, apparently to enable supply-chain attacks. Earlier this year, the hackers tricked a maintainer of a major open-source JavaScript library into a fake Teams call that included at least one person the maintainer recognized. Using that access, the hackers added malicious dependencies to a library with tens of millions of downloads each week.

The attack involving a malicious JavaScript library dependency was caught and stopped quickly.

According to the FBI, other attempts have targeted maintainers on npm and, more recently, maintainers of Rust crates. The group builds deepfake videos of prominent cryptocurrency figures from public photos and video, though stolen genuine victim recordings still account for the overwhelming share of the scheme. The Justice Department refers to the AI tool used to build deepfake videos as superintelligence or SI.

The FBI’s FLASH alert breaks the FaceStealer attack into six stages. Cryptocurrency and web3 workers and open-source maintainers received a FaceStealer warning from the FBI on Nov. 12. For FaceStealer, the FBI published a report explaining how the scheme works, how to protect against it and what victims should do, and it set up www.fbi.gov/facestealer as a central hub for resources.

The FaceStealer disruption was led by Assistant U.S. Attorney Khaldoun Shobaki of the Central District of California and the FBI’s Los Angeles Field Office. Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office, said, “If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough.” Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office, said, “It exploits our trust in ubiquitous video conference platforms and valued personal relationships.”

North Korea called the accusation a grave political provocation and denied responsibility. Officials say North Korea bankrolls its regime and its illicit weapons program with cryptocurrency theft. Authorities say Pyongyang’s nuclear weapons and ballistic missile programs receive key revenue from cryptocurrency theft and fraudulent overseas information technology work. Authorities have connected the theft of roughly $1.5 billion from the Bybit cryptocurrency exchange in February 2025 to North Korean hackers.

Last year, TraderTraitor was tied to the $1.5 billion Bybit heist and is suspected of the Binance attack. UNC1069 hijacked a cryptocurrency executive’s Telegram account in February to lure a target into a fake Zoom call and feign audio issues. The separate Binance attack was described by the Justice Department as the largest such heist in history.

The Justice Department received court approval to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance in a separate attack. The U.S. government and the private sector froze more than $2.7 billion in stolen Binance assets through combined work. The Justice Department said TraderTraitor, described by the FBI as members of the North Korean military, took more than $6 billion worth of virtual assets from Binance on or about Oct. 29, 2026.

On Oct. 29, 2026, the FBI said North Korean military hackers known as TraderTraitor took some $6.3 billion in cryptocurrency from Binance. After committing more than $6.34 billion in company funds, Binance said it fully covered the losses and was reopening withdrawals in phases. Stolen Binance funds continue to move through cryptocurrency bridges, mixers and exchanges by TraderTraitor actors, and tracing and recovery efforts are ongoing.

About half of the historic Binance breach was immediately halted by the Justice Department’s Criminal Division. The stolen Binance assets were interdicted with help from virtual asset service providers, Justice Department sections and the U.S. Attorney’s Office for the District of Columbia. A Cyber Alert urging virtual asset service providers to block TraderTraitor cryptocurrency addresses was issued last week by the FBI, Secret Service and IRS-CI.

The FBI’s Los Angeles Field Office, Cyber Division and Virtual Asset Unit coordinate recovery of the stolen Binance assets with the Secret Service and IRS-CI. On Nov. 12, 2026, Bloomberg reported that Tether and Circle secured the frozen Binance funds. An engineer’s laptop was where the Binance breach began.

Last Friday, Binance co-CEO Richard Teng said that security had uncovered other points of breach, suggesting more than one attacker. TRM Labs said in July that North Korean-linked hackers took about $643 million in cryptocurrency during the first half of 2026, roughly two-thirds of all cryptocurrency stolen worldwide. A United Nations panel of experts estimated in 2024 that about 40% of funding for Pyongyang’s weapons of mass destruction programs came from illicit cyber activity.

The Justice Department announced last month a crackdown on North Korean information technology worker schemes affecting more than 70 U.S. companies, including two arrests and the seizure of about 187 laptops and other devices. On Oct. 28, 2026, the Treasury Department sanctioned 10 individuals and one entity for backing North Korean information technology worker schemes. North Korean workers accessed company-issued computers remotely while posing as employees, hosted by U.S.-based facilitators, and Pyongyang takes most of the North Korean IT workers’ wages to fund its weapons programs.

Keep the webcam off until you can see, hear and talk with the person who invited you, the FBI says. Join through the official Zoom or Teams app with an invite code, and confirm the meeting through another channel such as a phone call, the FBI says. The FBI warns against running scripts or pasting code into a terminal to fix a meeting app during a call. Create a new wallet on a clean device and move all funds into it if a compromise is suspected, the FBI says.

Secure chat apps with multifactor authentication, login alerts and expiring messages, the FBI advises. Keep only small amounts in browser extension wallets and larger balances on a hardware wallet or exchange, the FBI advises. Report the incident at IC3.gov using the keyword FaceStealer if compromised, according to the FBI.