U.S. Justice Department Seizes Systems Tied to $400 Million Crypto Scheme

The U.S. Department of Justice (DOJ) seized cloud infrastructure tied to FaceStealer, a North Korea-linked operation linked to more than $400 million in crypto thefts over 18 months.

The DOJ and FBI disrupted cloud infrastructure used in deceptive video meetings. The operation targeted people largely working in crypto and Web3, along with maintainers of open-source software.

Investigators took possession of more than 900 video files showing victims, recorded without their knowledge during fraudulent sessions. The operation targeted five hacking groups associated with North Korea: Sapphire Sleet, UNC1069, Stardust Chollima, APT38 and BlueNoroff.

In a separate matter, the DOJ placed more than $1.2 billion in digital assets tied to North Korean actors and the Binance theft under freeze. That freeze concerns a different incident; the $400 million estimate applies to FaceStealer's 18-month theft total.

FaceStealer used social engineering — deception intended to gain victims' trust — during video calls.