U.S. Seizes $1.2B in Crypto Stolen by North Korea

WASHINGTON, D.C. — The Justice Department announced coordinated actions against North Korea's cryptocurrency theft schemes, including seizure of the FaceStealer infrastructure and court-authorized restraint of more than $1.2 billion stolen from Binance, officials announced on November 12, 2026.

Read the Department of Justice release: https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency

The actions target schemes by the government of the Democratic People's Republic of North Korea to fund its regime through the massive theft of cryptocurrency, according to the release.

The seizure covers cloud-based infrastructure used in the FaceStealer social engineering scheme, which resulted in the theft of more than $400 million worth of cryptocurrency, according to the release.

Separately, the Department obtained court authorization to seize or restrain more than $1.2 billion worth of cryptocurrency recently stolen from Binance, a virtual currency exchange, according to the release.

Fake Meetings, Recorded Webcams, And Deepfake Videos

North Korean hackers known publicly as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, Advanced Persistent Threat 38 (APT38), BlueNoroff, and Stardust Chollima lured targets with invitations to video meetings delivered from accounts stolen from prior victims, according to the release.

Once a target joined, the hackers recorded the target's webcam video and played a prerecorded video of a previous victim known to the target, simulating trusted contacts in the meeting, according to the release.

The hackers also used deepfake videos of well-known and influential individuals in the cryptocurrency and web3 industries to gain a target's trust, according to the release.

During the meeting, the hackers introduced a fake technical error, such as claiming the target could not be heard, and provided a link or prompt to fix it, according to the release.

The supposed fix surreptitiously installed malware on the target's computer, according to the release.

With a computer compromised, the hackers could steal cryptocurrency or exploit access to other infrastructure, and in several reported cases they stole cryptocurrency and hijacked communication accounts several months to more than a year after the initial compromise, according to the release.

The hackers also accessed a new victim's contact lists, social media, and communications apps to target the victim's personal and professional contacts, according to the release.

Crypto Workers, Open-Source Developers, And 900 Webcam Videos

The North Korean hackers targeted individuals working in the cryptocurrency and web3 industries, according to the release.

They have increasingly targeted individuals involved in the development and maintenance of open-source software, in what officials described as an attempt to enable software supply-chain attacks, according to the release.

Pursuant to a federal warrant, the FBI seized over 900 webcam videos of FaceStealer victims, according to the release.

The FBI published a report on the mechanics of the FaceStealer scheme, including best practices and steps victims can take, and created a resource site at www.fbi.gov/facestealer, according to the release.

The disruption effort was led by Assistant U.S. Attorney Khaldoun Shobaki for the Central District of California and the FBI's Los Angeles Field Office, according to the release.

"North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft," said Principal Deputy Assistant Attorney General for National Security M. Scott Proctor, according to the release. "Today's announcement shows that America will fight back against that corrupt regime's effort to profit through cybercrime."

"The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," said FBI Cyber Branch Operations Director Brett Leatherman, according to the release.

A $6 Billion Binance Theft, $2.7 Billion Frozen, And An Ongoing Recovery

On or about October 29, 2026, members of the North Korean military, referred to by the FBI as TraderTraitor, stole more than $6 billion worth of virtual assets from the Binance cryptocurrency exchange, according to the release.

Since the theft, the National Security Division's National Security Cyber Section, the Criminal Division's Computer Crime and Intellectual Property Section, the U.S. Attorney's Office for the District of Columbia, and law enforcement partners have worked with virtual asset service providers to interdict the stolen assets, according to the release.

Collective U.S. government and private sector efforts have resulted in the freeze of more than $2.7 billion, with the Department having already obtained court authorization to seize or restrain in excess of $1.2 billion of that amount, according to the release.

Efforts to trace, freeze, seize, and forfeit the stolen virtual assets are ongoing, as TraderTraitor actors continue to launder assets through various cryptocurrency bridges, mixers, and exchanges, according to the release.

Last week, the FBI, in coordination with the United States Secret Service and IRS Criminal Investigation, issued a Cyber Alert attributing the theft and urging virtual asset service providers to block transactions with or derived from cryptocurrency addresses the actors are using to launder the stolen Binance assets, according to the release.

The FBI's Los Angeles Field Office, Cyber Division, and Virtual Asset Unit are coordinating the FBI's recovery efforts, in partnership with the Secret Service and IRS Criminal Investigation, according to the release.

Anyone who believes they may have been targeted by the FaceStealer scheme can review the FBI's guidance at www.fbi.gov/facestealer and report information through the FBI's Internet Crime Complaint Center at ic3.gov.

Sources U.S. Department of Justice, Office of Public Affairs — Official Press Release, November 12, 2026: https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency