DOJ: North Korean Hackers Stole $400 Million Via Deepfake Video Calls, Moves to Seize $1.2 Billion From Binance Hack

The U.S. Justice Department said Thursday it has seized the infrastructure behind "FaceStealer," a North Korean social-engineering operation that it says stole more than $400 million in crypto over the past 18 months, according to Decrypt, which cited the DOJ announcement.

The scheme weaponizes video calls. Per the DOJ, attackers lure targets into meetings using accounts stolen from earlier victims, then play prerecorded webcam footage of trusted contacts to fake their live presence; the FBI calls the scheme FaceStealer. The group also generates AI deepfakes of known figures in crypto and adjacent industries to make the ruse more convincing. Once a target is comfortable, the hackers stage a fake glitch — claiming they can't be heard — and offer a "fix" link that installs malware, the DOJ said. From there they drain wallets or pivot into connected systems, sometimes waiting months before striking. The FBI said it seized more than 900 webcam recordings of victims under a federal warrant.

The DOJ tied the operation to North Korean groups tracked as Sapphire Sleet, BlueNoroff and APT38, and warned the hackers are increasingly targeting open-source software developers, apparently to set up supply-chain attacks.

Separately, the department said it has obtained court authorization to seize or restrain more than $1.2 billion of the roughly $6.4 billion stolen from Binance on Oct. 29 — part of over $2.7 billion frozen so far. The FBI attributed that theft to the North Korean group TraderTraitor and said the regime is laundering proceeds rapidly, spinning up a new wallet roughly every 25 seconds.

Key facts

• FaceStealer scheme stole over $400 million in crypto across 18 months (DOJ, via Decrypt).
• FBI seized 900+ webcam recordings of victims under a federal warrant (DOJ, via Decrypt).
• $1.2 billion now authorized for seizure from the Binance hack; over $2.7 billion frozen to date (DOJ, via Decrypt).
• Binance theft dated Oct. 29; attributed to TraderTraitor; new laundering wallet created ~every 25 seconds (FBI, via Decrypt).
• Groups named: Sapphire Sleet, BlueNoroff, APT38 (FaceStealer); TraderTraitor (Binance) (DOJ/FBI, via Decrypt).

The real-world read

Two notes of caution. First, the size of the Binance hack isn't settled: the Decrypt report puts the total stolen at "roughly $6.4 billion," while an embedded headline in the same piece cites "$6.3B." The DOJ's recovery figures ($1.2 billion authorized, $2.7 billion frozen) are law-enforcement claims, not independently confirmed recoveries. Second, attribution is contested — North Korea has publicly denied involvement in the Binance breach, with Kim Yo Jong calling the FBI's finding a "grave political provocation," per Yonhap and state media KCNA cited by Decrypt. These are U.S. government allegations announced alongside an enforcement action; no court has yet ruled on them.

Opinion, and whose

The DOJ frames crypto theft as central to Pyongyang's finances, pointing to recent sanctions on 11 people over a North Korean IT-worker scheme — its characterization, not an adjudicated fact. North Korea rejects the attribution outright.

Sources

• Decrypt (Nov. 12, 2026) — reputable secondary reporting; relayed the DOJ/FBI announcement on FaceStealer and the Binance seizure, and quoted North Korea's denial via Yonhap/KCNA. The underlying primary source is the DOJ's own statement, which was not directly available here. Not marketing.

This is news reporting, not financial advice.