U.S. Seizes FaceStealer Cloud Systems in Crypto Theft Exceeding $400 Million

The Justice Department announced Nov. 12 it seized cloud infrastructure used by FaceStealer, which U.S. authorities link to North Korea and associate with more than $400 million in crypto losses over 18 months.

Operators used video conferences and deepfake footage to impersonate trusted contacts or prominent figures in crypto, persuading victims to install malicious software. The campaign increasingly targeted open-source software developers and maintainers, seeking access to their devices and code repositories as well as targeting crypto holders and Web3 workers.

Under a federal search warrant, the FBI seized more than 900 recordings from victims’ webcams and issued guidance on preventing and responding to the attacks.

A separate Binance theft case was also part of the Nov. 12 actions. U.S. authorities and private firms had frozen more than $2.7 billion in assets in that case, with courts authorizing seizure or transfer restrictions on more than $1.2 billion.