DOJ Seizes North Korea FaceStealer Setup, Freezes $1.2B in Binance Crypto

The Justice Department and the FBI moved on the cloud-based infrastructure powering FaceStealer, a North Korean social-engineering operation, and froze more than $1.2 billion in digital assets tied to the Binance theft. The announcement landed between November 10 and 12, 2026. The action targeted several state-sponsored hacking crews: Sapphire Sleet, UNC1069, Stardust Chollima, APT38 and BlueNoroff.

Investigators walked away with more than 900 webcam videos that had been secretly recorded from victims, all linked to the fraudulent video-conferencing sessions at the heart of the scheme. Most of the people caught on those recordings worked in crypto and Web3. Open-source software maintainers were also on the target list.

The money side is split in two. The Binance theft — attributed to North Korean groups on October 29, 2026 — took more than $6 billion. The freezes have come in waves: an estimated $2.8 billion first, with the latest round adding the further $1.2 billion. The $400 million blamed on FaceStealer is a separate figure, covering thefts from the video-call scheme over 18 months, not the Binance incident.

None of it required cracking cryptography. FaceStealer ran entirely on people trusting what they saw on a video call. Those 900-plus recordings each mark a moment when someone believed they were just taking a meeting.