The Department of Justice announced coordinated actions on November 12, 2026, to disrupt North Korean cryptocurrency theft schemes, including seizing infrastructure for the FaceStealer social engineering campaign and restraining over $1.2 billion stolen from Binance.
FaceStealer Infrastructure Disrupted
The FBI and the U.S. Attorney's Office for the Central District of California disrupted cloud-based infrastructure used in the FaceStealer social engineering scheme. The campaign has stolen more than $400 million over 18 months by targeting cryptocurrency and Web3 sectors, as well as open-source software supply chain developers.
Hackers used stolen accounts, recorded webcam videos, pre-recorded videos, and artificial deepfakes in video meetings to gain victims' trust. They then introduced fake technical errors to prompt malware installation.
Binance Asset Interdiction
Separately, on or about Oct. 29, members of the North Korean military referred to as TraderTraitor stole more than $6 billion in virtual assets from the Binance cryptocurrency exchange. U.S. government agencies and private sector partners froze more than $2.7 billion, with the Department of Justice obtaining court authorization to seize or restrain over $1.2 billion.
What to do
- Review the FBI report providing details on the mechanics of the FaceStealer scheme and best practices to protect against it at www.fbi.gov/facestealer.
Key facts and where they come from
- The FaceStealer scheme has resulted in the theft of more than $400 million in cryptocurrency over the last 18 months.
resulting in the theft of more than $400 million in the last 18 months
- The U.S. government restrained and seized more than $1.2 billion stolen from Binance.
seize or restrain in excess of $1.2 billion of that amount.
- North Korean actors known as TraderTraitor stole over $6 billion from Binance on or about October 29.
stole more than $6 billion worth of virtual assets from the Binance cryptocurrency exchange.
Hacking Techniques tracker: how this works, how it is advancing and how to defend — Help-desk and phone social engineering · Software supply-chain attacks · Crypto wallet and exchange theft
