U.S. authorities seize infrastructure supporting a sophisticated cybercrime campaign that used stolen webcam footage, deepfake videos and malicious meeting invitations to compromise cryptocurrency holders and software developers. The Federal Bureau of Investigation has revealed that North Korean state-backed hackers stole more than $400 million in cryptocurrency over 18 months through a sophisticated social engineering operation known as FaceStealer. In a November 12, 2026, announcement, the U.S. Department of Justice confirmed that federal authorities had seized cloud infrastructure supporting the operation, which targeted cryptocurrency investors, Web3 professionals and open-source software developers.
The attackers used secretly recorded webcam footage and artificial intelligence-generated deepfakes to impersonate trusted individuals during online meetings, tricking victims into installing malicious software. The FBI attributed the campaign to North Korean cyber actors associated with Sapphire Sleet, also tracked as UNC1069, and related hacking groups. Investigators also recovered more than 900 webcam videos belonging to victims, exposing the scale of the impersonation operation. The announcement accompanied separate government actions involving billions of dollars stolen from cryptocurrency exchange Binance in October.
Hackers Exploited Video Meetings to Steal Cryptocurrency
According to the FBI, FaceStealer relied on compromised messaging and social media accounts to approach new victims through seemingly legitimate meeting invitations. Targets received invitations appearing to originate from colleagues, business partners or other trusted contacts whose accounts had already been compromised. During the meetings, attackers displayed prerecorded footage of familiar individuals or AI-generated videos impersonating prominent cryptocurrency industry figures. The hackers simultaneously recorded the new victims, collecting additional footage for subsequent impersonation attempts. Once trust had been established, attackers introduced fabricated technical problems, frequently claiming that a microphone or audio connection was malfunctioning.
Victims were instructed to download software or follow a troubleshooting link, which secretly installed malware capable of compromising their computers and cryptocurrency accounts. In several cases, attackers delayed exploiting compromised accounts for months, sometimes more than a year, before stealing assets or using the accounts to approach additional targets. The FBI warned that the technique had expanded beyond cryptocurrency theft to individuals maintaining widely used open-source software repositories. Compromising those developers could provide opportunities for software supply-chain attacks affecting additional organizations and users.
U.S. Seizes Infrastructure and Targets Separate Binance Hack
The Justice Department’s November 12 operation disrupted cloud infrastructure used to support FaceStealer, although authorities did not claim that every associated attacker had been identified or apprehended. The FBI recommended independently verifying unexpected meeting invitations, avoiding unfamiliar software downloads and treating unsolicited technical troubleshooting requests as potential security threats. Separately, U.S. authorities announced progress in recovering cryptocurrency stolen during the October 29 Binance breach. The government obtained court authorization to seize or restrain more than $1.2 billion in stolen cryptocurrency, while public-private cooperation had frozen more than $2.7 billion.
The Binance theft involved more than $6 billion in digital assets and was attributed to a North Korean operation identified as TraderTraitor. Importantly, investigators have not established that FaceStealer was responsible for the Binance breach. The two operations were announced together but remain distinct investigations. U.S. officials have repeatedly accused North Korea of using cryptocurrency theft to finance government operations and prohibited weapons programs. The latest findings demonstrate how increasingly sophisticated impersonation techniques can compromise cryptocurrency security without directly exploiting blockchain protocols. For exchanges, institutional investors and software developers, the operation reinforces the importance of identity verification, endpoint security and controls protecting access to digital assets.
