WASHINGTON — US authorities have moved to disrupt digital infrastructure used in a North Korean-linked cryptocurrency theft operation that allegedly stole more than $400 million over 18 months through deceptive video meetings, deepfake material and social engineering.
The US Department of Justice said on November 12 that investigators seized cloud infrastructure associated with a campaign known as “FaceStealer”. The operation targeted people in the cryptocurrency and Web3 industries and increasingly sought access to individuals involved in open-source software development and maintenance.
How the alleged operation worked
According to the Justice Department, attackers sent invitations to video meetings from accounts previously compromised through earlier victims. Once a target joined, hackers could record the person’s webcam video and play prerecorded footage of someone familiar to the target, creating the impression that a trusted contact was participating.
The attackers then introduced a supposed technical problem and directed the target to a link or prompt to resolve it. The proposed fix installed malicious software, potentially giving the attackers access to cryptocurrency accounts, communications and other systems. Authorities said artificial-intelligence-generated deepfakes were also used to impersonate influential people in the digital-asset industry.
The FBI said the campaign had resulted in more than $400 million in cryptocurrency theft during the previous 18 months. The Justice Department also said a federal warrant enabled the seizure of more than 900 webcam videos of victims.
Wider digital-asset recovery effort
The department separately said it had obtained court authorisation to seize or restrain more than $1.2 billion in cryptocurrency recently stolen from Binance. US authorities and private-sector partners said their combined efforts had frozen more than $2.7 billion in assets, although tracing and recovery work remains ongoing.
The FaceStealer operation and the Binance-related asset recovery are distinct strands of the government’s actions. They illustrate the range of methods used by state-linked cyber actors and the difficulty of tracing digital assets across exchanges, bridges and other services.
Implications for businesses and investors
The case is a warning for firms that rely on video calls, messaging platforms and open-source software. Businesses should verify meeting invitations through a separate trusted channel, avoid installing software through unexpected meeting prompts, use strong multi-factor authentication and maintain controls over access to software repositories and digital wallets.
The allegations and figures in this report are those stated by US authorities; asset forfeiture and recovery proceedings remain subject to legal process.
Sources: US Department of Justice — FaceStealer disruption announcement; Reuters reporting on the FBI investigation.