FBI seizes infrastructure used in North Korean FaceStealer scheme
Original title: FBI Disrupts North Korean FaceStealer Attacks Linked to $400 Million in Crypto Theft
The scheme is tied to more than $400 million in crypto theft, while agencies have frozen over $2.7 billion from a separate Binance theft.
The U.S. Justice Department and FBI said on November 12, 2026, that they seized cloud infrastructure behind FaceStealer, a North Korean social-engineering scheme linked to more than $400 million in cryptocurrency theft over 18 months. Operators hijack messaging accounts, lure contacts into fake Zoom or Teams calls, play stolen webcam video, and then push a fake audio fix that installs a cookie harvester, keylogger, screen capturer, and backdoor. Investigators seized more than 900 videos. The same announcement covers an FBI-attributed theft of about $6 billion from Binance by TraderTraitor; more than $2.7 billion has been frozen and courts have authorized seizure or restraint of over $1.2 billion.
Unconfirmed: The $400 million and $6 billion theft figures are attributions stated by U.S. agencies, not independently confirmed in the item.
- Lures use hijacked Telegram, LinkedIn, Slack, and Discord accounts plus Calendly and lookalike meeting links.
- A fake Teams call targeted a major JavaScript library maintainer; fast detection stopped malicious dependencies.
- Wallet drains sometimes waited months or more than a year while balances were watched.
- TraderTraitor is said to launder funds through bridges, mixers, and exchanges, mostly into Ethereum.
Impact: Stolen cryptocurrency, credentials, and webcam recordings
- 1.Join calls through official apps and keep webcams off until the host is verified.
- 2.Never paste commands offered as a meeting audio fix.
- 3.Move funds to a new wallet with fresh seed phrases and report to IC3.gov using “FaceStealer.”
- Threat actors
- Sapphire SleetTraderTraitorAPT38BlueNoroff
- Malware
- FaceStealer
- Victims
- Binance
- Organizations
- FBIU.S. Justice Department
From the original article
2 min read at gbhackers.com
The U. S. Justice Department and the FBI have seized the cloud infrastructure behind “FaceStealer,” a North Korean social engineering scheme connected to over $400 million in cryptocurrency theft in the past 18 months.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.