FBI Disrupts North Korean FaceStealer Operation Linked to Major Cryptocurrency Thefts
In a significant operation, the U.S. Justice Department and the FBI have successfully seized the cloud infrastructure behind a notorious North Korean scheme known as “FaceStealer.” This operation is linked to over $400 million in cryptocurrency theft carried out in the last 18 months, underscoring the severe implications of international cybercrime.
On November 12, 2026, federal authorities announced the operation, which not only disrupted the FaceStealer activities but also targeted an extensive theft from Binance, amounting to approximately $6 billion. This latter theft has been attributed to a North Korean military group referred to as “TraderTraitor.” The FBI and Justice Department have recognized the complex interplay of state-sponsored cyber operations and their effects on global financial systems.
The FaceStealer operation is attributed to a variety of state-sponsored actors, including groups identified as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima. These actors employ sophisticated social engineering tactics to compromise the accounts of genuine users on platforms like Telegram, LinkedIn, Slack, and Discord. After hijacking these accounts, they message victims’ contacts to suggest a meeting, often under misleading pretenses.
How FaceStealer Operates
Once a target has been identified, the attackers send out invites via Calendly for a supposed catch-up call. Just before the meeting, they provide a seemingly legitimate link to Zoom or Microsoft Teams, which has been manipulated to appear authentic, a tactic known as “typo-squatting.” Researchers indicate that similar techniques were previously seen in a campaign involving AI-generated Zoom links, which leveraged fileless PowerShell scripts.
Upon joining the fake meeting, unsuspecting participants are shown secretly recorded webcam footage of previous victims, creating a deceptive sense of trust. The attackers also record new participants’ camera feeds, dramatically increasing their ability to create deepfake scenarios for future exploitation. Investigators from the FBI report having seized more than 900 such recordings, revealing the extent of the operation.
The actors behind FaceStealer have now begun employing advanced tools, including “super intelligence,” to create deepfakes of significant figures in the cryptocurrency and Web3 sectors, although they still predominantly rely on genuine, stolen footage to execute their schemes.
Infection Tactics and Broader Implications
The infection tactic utilized by these cybercriminals is deceptively simple. Posing as a trusted contact, the attacker claims that the victim’s audio is malfunctioning and guides them through a series of supposed fixes. These could be an update prompt, a malicious script, or code that is pasted directly into the terminal. This method effectively installs a suite of malicious tools, including cookie harvesters, keyloggers, screen capturers, and backdoors.
In numerous instances, attackers have exhibited patience, waiting months or even over a year before draining compromised wallets, carefully monitoring their victims’ account balances as they grew.
In a FLASH advisory issued by the FBI, cybersecurity professionals are urged to adopt several precautions: joining virtual meetings through verified applications with unique invite codes, keeping webcams off until verification of the host occurs, and avoiding the pasting of commands to fix potential meeting issues.
The FaceStealer campaign has extended its reach into software supply chains. Earlier this year, attackers were able to lure a major maintainer of an open-source JavaScript library into a fake Teams call, where they attempted to publish malicious dependencies to a widely used package garnering tens of millions of weekly downloads. Fortunately, rapid detection thwarted this attack, but it highlights the ever-growing risk of software supply chain vulnerabilities.
Legal and Financial Repercussions
On the Binance front, U.S. agencies, in collaboration with private partners, have frozen more than $2.7 billion in assets. Courts have authorized the seizure or restraint of over $1.2 billion of this total. The TraderTraitor group has continued to launder these funds through various channels, including bridges, mixers, and exchanges, predominantly converting assets to Ethereum. The FBI has urged virtual asset service providers to block transactions linked to the identified addresses to mitigate further losses.
For individuals who have fallen victim to these schemes, the FBI recommends transferring funds to a new wallet with fresh seed phrases, securing their messaging accounts with multifactor authentication, and informing their contacts. Victims are encouraged to report incidents to IC3.gov, using the keyword “FaceStealer” for reference.
As cyber threats evolve, the FBI’s proactive measures and public advisories are crucial in safeguarding against the intricacies of social engineering and indiscriminate cyberattacks. The continuing evolution of advanced tactics utilized by state-sponsored actors makes this an ongoing battle for cybersecurity professionals and law enforcement alike.