North Korean state-backed hackers have stolen more than $400 million in cryptocurrency over the past 18 months using secretly recorded images of their victims, the FBI said on Thursday, 12 November 2026. The US Department of Justice announced coordinated action to disrupt the scheme, which it calls FaceStealer, including the seizure of cloud-based infrastructure used by the hackers.

The FBI said the operation targeted people working in cryptocurrency and Web3, and that the stolen funds help finance North Korea's illicit weapons programme. The announcement was made alongside a separate court-authorised seizure and restraint of more than $1.2 billion in cryptocurrency recently stolen from the Binance exchange.

How the FaceStealer scheme worked

According to the Department of Justice, the hackers lured targets with invitations to video meetings sent from accounts stolen from earlier victims. The meetings took place on imposter versions of video conferencing software such as Zoom, Microsoft Teams and Google Meet. During the calls, the hackers surreptitiously recorded video of the victims, and then used those images, sometimes combined with artificial intelligence deepfakes, to approach the victims' contacts and win their trust.

The FBI said it had identified and seized more than 900 webcam videos of FaceStealer victims under a federal warrant. The scheme also involved attempts to compromise people working in the open-source software supply chain, widening the potential damage beyond individual crypto holders.

“North Korean cyber actors have used the FaceStealer scheme to aggressively target individuals in the cryptocurrency and Web3 sectors through deceptive social engineering tactics, resulting in the theft of more than $400 million in the last 18 months,” said FBI Cyber Branch Operations Director Brett Leatherman, in a statement published by the Department of Justice.

Who the FBI blames

The FBI attributed FaceStealer to a cluster of North Korean hackers known as Sapphire Sleet, also tracked as UNC1069. The Department of Justice also named the groups Dangerous Password, CryptoCore, Advanced Persistent Threat 38 (APT38), BlueNoroff and Stardust Chollima as being involved in the scheme.

Reuters reported that Sapphire Sleet is a separate group from the North Korean hackers linked to the recent theft of more than $6 billion from Binance, which the FBI has attributed to a group it calls TraderTraitor. The distinction matters because it shows that more than one North Korean hacking operation is active at the same time, each using different methods to steal cryptocurrency.

The wider crackdown on North Korean crypto theft

The disruption of the FaceStealer infrastructure was led by the US Attorney's Office for the Central District of California and the FBI's Los Angeles Field Office. The FBI has published a report explaining how the scheme works, with advice on how to guard against it and what victims should do if they have been compromised. It has also set up a dedicated information hub at fbi.gov/facestealer.

Leatherman said the FBI remained committed to “identifying, disrupting, and imposing cost on North Korean actors targeting the virtual asset community”. The Department of Justice said North Korea relies on large-scale cryptocurrency theft to fund its regime, and that it has stolen billions of dollars in recent years.

The FaceStealer disruption is the latest in a series of US actions against North Korean cyber operations, which have previously included the Binance theft and the 2025 theft of $1.5 billion from the Bybit exchange. For people working in crypto, the case is a reminder that a video call invitation, even one that appears to come from a known contact, can be the first step in a carefully planned theft.

Sources: Reuters; US Department of Justice.