US Seizes Infrastructure Used By North Korean Hackers In $400 Million Cryptocurrency Scam

The United States has seized cloud infrastructure allegedly used by North Korean hackers in a video-call scam known as FaceStealer, which stole more than $400 million in cryptocurrency over 18 months. The hackers reportedly used prerecorded videos, compromised accounts and AI-generated deepfakes to trick victims into installing malware. Separately, US authorities have obtained court approval to seize or restrain more than $1.2 billion linked to the $6 billion Binance cryptocurrency theft, which the FBI also attributes to North Korean hackers.

The United States Department of Justice has seized cloud infrastructure allegedly used by North Korean hackers to carry out a sophisticated video-call scam that stole more than $400 million in cryptocurrency over an 18-month period.
The operation, known as FaceStealer, involved hackers impersonating trusted contacts during online meetings to deceive victims into installing malicious software. The attackers reportedly used compromised accounts, recorded webcam footage and, increasingly, artificial intelligence-generated deepfakes to make their deception more convincing.
The Justice Department also announced that it had obtained court authorisation to seize or restrain more than $1.2 billion linked to a separate cryptocurrency theft involving Binance.
The two operations are connected to different North Korean hacking groups, highlighting the range of cybercrime methods authorities say are being used to generate money for the isolated country's government.

HOW THE FACESTEALER VIDEO-CALL SCAM WORKED

The Federal Bureau of Investigation (FBI) identified the operation as FaceStealer, a scheme designed to exploit trust between colleagues, business partners and professional contacts.
According to the Justice Department, hackers began by taking control of online accounts belonging to previous victims. They then used those accounts to send meeting invitations to new targets.
When a target joined the video call, the attackers recorded their webcam footage. They subsequently played prerecorded videos of people the target knew, creating the impression that trusted colleagues or business contacts were participating in the meeting.
The hackers also reportedly began using AI-generated deepfakes of prominent cryptocurrency figures to make their impersonations more convincing.
After establishing trust, the attackers staged a fake technical problem and told the victim that a link would help resolve it. Clicking the link installed malware on the victim's device, giving the hackers an opportunity to gain access to sensitive information and potentially cryptocurrency accounts.
The operation was particularly dangerous because the criminals did not always steal money immediately. In some cases, they reportedly waited several months or more than a year before taking the funds.
This delay made it harder for victims to connect the eventual theft with the original video meeting.

HACKERS USED VICTIMS' CONTACTS TO FIND NEW TARGETS

The FaceStealer operation relied heavily on existing professional relationships to identify new victims.
After compromising an account, hackers could use the victim's contacts and communication networks to approach other people who were likely to trust the stolen identity.
Most of the identified targets worked in cryptocurrency and other internet-related industries. However, the FBI said the attackers were increasingly targeting open-source software developers.
This development has raised concerns about possible supply-chain attacks, in which criminals compromise software developers or their tools to gain access to systems used by many other organisations.
The Justice Department said the FBI seized more than 900 webcam videos belonging to victims under a federal warrant.
Patrick Grandy, who leads the FBI's Los Angeles field office, warned that people should not assume they are too experienced or knowledgeable to fall victim to such schemes.
His warning reflects the growing sophistication of cybercriminals, who are increasingly combining social engineering, malware and artificial intelligence to deceive even technically skilled individuals.

US AUTHORITIES TARGET NORTH KOREAN CYBERCRIME NETWORKS

The FBI linked FaceStealer to a hacking group known as Sapphire Sleet, also identified as UNC1069.
The group is separate from the North Korean-linked hackers accused of carrying out the major Binance cryptocurrency theft.
The distinction is important because the two operations involved different criminal networks and methods, even though US authorities associate both with North Korea.
Washington has repeatedly accused North Korean-linked cybercriminals of stealing digital assets to generate revenue for the country's government and support activities that include its weapons programmes.
North Korea has denied involvement in the Binance theft.

BINANCE HACK TRIGGERS A SEPARATE CRYPTOCURRENCY RECOVERY OPERATION

Alongside the FaceStealer seizure, the Justice Department announced that it had secured court approval to seize or restrain more than $1.2 billion connected to the Binance hack.
The FBI attributed that separate theft to a group known as TraderTraitor, which it linked to North Korea.
According to the investigation, the hackers stole more than $6 billion in cryptocurrency on or around October 29. The Associated Press reported an estimated loss of approximately $6.3 billion, describing it as the largest cryptocurrency theft on record.
US government agencies and private companies have since frozen more than $2.7 billion connected to the incident, according to the Justice Department.
Freezing cryptocurrency does not necessarily mean that the money has been returned to its rightful owners. Authorities generally have to pursue legal forfeiture proceedings, after which a court determines who is entitled to the recovered assets.
The latest court authorisation therefore represents another step in the effort to prevent the stolen funds from being moved or spent.

WHY CRYPTOCURRENCY THEFT MATTERS TO NORTH KOREA

US officials have repeatedly argued that cryptocurrency theft provides North Korea with a way to obtain foreign currency despite international sanctions and restrictions on its access to global financial systems.
M. Scott Proctor, the Justice Department's principal deputy assistant attorney general for national security, said the North Korean government uses cryptocurrency theft to finance its activities and illicit weapons programme.
Digital currencies can be attractive to cybercriminals because transactions can move across international platforms and jurisdictions. Although many blockchain transactions are publicly recorded, identifying the people controlling particular wallets and recovering stolen assets can be difficult.
The scale of the alleged thefts has therefore increased pressure on cryptocurrency exchanges, technology companies and governments to strengthen security and cooperate in tracking suspicious transactions.

CYBERSECURITY WARNINGS AS AI-POWERED SCAMS BECOME MORE SOPHISTICATED

The FaceStealer investigation highlights the risks associated with trusting familiar faces and voices during online meetings.
Traditional advice has encouraged users to verify unfamiliar links and avoid downloading suspicious files. However, the reported use of prerecorded videos and AI-generated deepfakes means that visual familiarity alone may no longer provide reliable proof of someone's identity.
Individuals and businesses can reduce their exposure by independently confirming unexpected meeting invitations, checking unusual software update requests through official channels and using strong authentication measures to protect their accounts.
Organisations working in cryptocurrency and software development also need to monitor devices and accounts for unusual activity, since attackers may remain inside compromised systems for extended periods before stealing funds.

US INVESTIGATIONS CONTINUE AS AUTHORITIES PURSUE STOLEN FUNDS

The seizure of the FaceStealer infrastructure and the separate legal action involving Binance demonstrate the growing efforts by US authorities to disrupt cybercrime networks and recover stolen digital assets.
However, taking control of servers and freezing cryptocurrency are only parts of the wider process. Investigators must still trace the stolen funds, establish the identities of those responsible and complete the legal procedures required for recovery.
For cryptocurrency users and technology companies, the cases serve as a reminder that cybercriminals are increasingly exploiting trusted relationships and advanced digital tools to gain access to valuable assets.
The investigations also highlight the international challenge of confronting cybercrime networks that operate across borders and use digital currencies to move money between jurisdictions.