U.S. Department of Justice Seizes FaceStealer Cloud Infrastructure Linked to Theft of $400 Million in Crypto Assets

on November 13, according to Cryptopolitan, the U.S. Department of Justice stated that the FBI has assessed the cryptocurrency assets stolen by the North Korean hacker-led FaceStealer operation over an 18-month period at over $400 million, and has dismantled the scam's cloud infrastructure; utilizing federal search warrants, the FBI seized more than 900 webcam video recordings of victims. The DOJ noted that the gang compromised existing victims' accounts to invite new targets to video calls, played pre-recorded webcam clips of the targets' acquaintances, used deepfake videos to impersonate influential figures in the crypto and Web3 sectors, and then lured targets into clicking links and installing malware under the guise of false audio glitches, ultimately stealing cryptocurrency assets or leveraging the victims' access to other systems.

The DOJ linked the scheme to North Korean-affiliated groups such as Sapphire Sleet, UNC1069, APT38, and BlueNoroff. The agency also secured court authorization to seize or freeze over $1.2 billion stolen from Binance, reporting that it has already locked down more than $2.7 billion in total funds; it attributed the outflow of over $6 billion from the exchange around October 29 to North Korean military hackers dubbed TraderTraitor, which Pyongyang denies.