DOJ Disrupts FaceStealer Scheme Tied to More Than $400 Million in Crypto Theft

The U.S. Justice Department said Thursday it disrupted cloud infrastructure used in a North Korean crypto-theft scheme that it says stole more than $400 million over 18 months.

The FBI calls the operation FaceStealer. The FBI says hackers took over accounts belonging to targets’ contacts and invited crypto workers to fake Zoom or Microsoft Teams meetings. It says they played recordings of trusted people and staged technical problems to persuade targets to install malware. The FBI says AI-generated deepfakes of prominent crypto and Web3 figures have also appeared, but stolen recordings of real people remain the scheme’s dominant method.

The FBI said it seized more than 900 webcam videos under a federal warrant. That figure counts videos, not a confirmed number of people.

Separately, government and private-sector efforts had frozen more than $2.7 billion tied to the Binance theft on or about Oct. 29, which involved more than $6 billion in virtual assets; courts authorized seizure or restraint of more than $1.2 billion of those funds. The FBI attributes the theft to TraderTraitor, a separate North Korean operation.

The FBI says FaceStealer actors have increasingly targeted open-source developers, apparently to gain access to software repositories.