FaceStealer: FBI Disrupts Fake Video Call Crypto Scam
The FBI and the U.S. Department of Justice have disrupted FaceStealer, a North Korean social engineering campaign that used hijacked accounts, replayed webcam footage and fake video calls to steal more than $400 million in cryptocurrency over the past 18 months. The DOJ announced on November 12, 2026, that it had seized cloud-based infrastructure behind the operation, and the FBI seized more than 900 webcam videos of victims under a federal warrant.
The same announcement covered a separate action: court authorization to seize or restrain more than $1.2 billion from the October 29 Binance theft, which the FBI attributes to the North Korean cluster it calls TraderTraitor.
A Meeting Invite From a Familiar Contact
FaceStealer does not start with a stranger. The lure arrives from a real account belonging to an earlier victim, which makes the invitation look routine. The DOJ announcement and coverage of the FBI’s FLASH report (AC-111226-MS) describe the sequence as follows:
- Hijacked account: A compromised profile on a platform such as Telegram, LinkedIn, Slack or Discord sends the target an invitation to a video meeting; reporting on the FBI’s findings mentions Calendly links to Zoom or Teams calls
- Staged call: Once the target joins, the attackers record the target’s webcam and play prerecorded footage of earlier victims, so people the target knows appear to be on the call; the DOJ says deepfake videos of well-known crypto and Web3 figures were also used
- Fake technical problem: The attackers stage an audio or connection fault, such as the target supposedly not being heard, and offer a link or prompt to “fix” it
- Malware installation: The “fix” installs malware on the target’s machine
- Delayed theft: The attackers drain wallets or use the access against other infrastructure, sometimes months or more than a year after the initial compromise
- Next round: Contact lists, social media and messaging apps from the new victim feed the next wave of invitations, and the new victim’s webcam recording can become the next prop
That is why the FBI’s seizure of more than 900 webcam videos matters: each recording was potential bait for a victim’s own contacts.
What the Malware Is Built to Take
Neither the DOJ nor the FBI has publicly named the malware families. Coverage of the FBI report describes the payload as a toolkit rather than a single implant: a browser cookie harvester, keyloggers, screen capture tools and a backdoor.
Some reports also note that the “fix” can take the form of a script or a command the victim is told to paste into a terminal, mirroring tactics seen in ClickFix campaigns.
That combination targets session tokens and credentials as much as wallets. Stolen browser cookies can let attackers take over messaging, email and exchange accounts without passwords or MFA prompts, which fits the long gap the FBI describes between infection and theft.
From Crypto Wallets to Open-Source Maintainers
The campaign’s core targets have been people in the cryptocurrency and Web3 sectors. The DOJ says the campaign has increasingly turned to developers and maintainers of open-source software, a shift it describes as apparently calculated to enable software supply chain attacks.
The FBI says it is aware of attempts against maintainers of npm packages and Rust crates. One JavaScript maintainer was nearly drawn into a fake Teams meeting earlier this year; the FBI has not shared further details. A maintainer’s compromised workstation could give attackers publishing rights to a widely used package, which would turn a single social engineering success into a downstream compromise affecting many organizations.
Which North Korean Groups Are Behind FaceStealer?
The DOJ attributes FaceStealer to North Korean hackers publicly tracked under several names: Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. An FBI official separately told reporters the scheme is attributed to APT38. These are designations different organizations use for overlapping, financially motivated North Korean activity.
Federal authorities attribute the Binance attack to a different threat actor, TraderTraitor, which the DOJ links to North Korea’s military. North Korea denies the allegations. Prosecutors consider the heist separate from FaceStealer, and the FBI says it is unclear if the attackers used FaceStealer’s methods to breach Binance.
How Big Was the Binance Recovery?
| Item | Figure |
|---|---|
| Date of the Binance theft | On or about October 29, 2026 |
| Amount stolen | More than $6 billion, per the DOJ (press estimates range from $6.3 billion to $6.4 billion) |
| Funds frozen | More than $2.7 billion |
| Court-authorized seizure or restraint | More than $1.2 billion of the frozen funds |
| Attribution | TraderTraitor (FBI) |
The FBI has urged virtual asset service providers to block transactions tied to addresses used by TraderTraitor. Researchers tracking the laundering describe automated, fast-moving wallet hops and token tricks in decentralized exchange liquidity pools, which leaves exchanges a short window to act on flagged addresses.
What the Infrastructure Seizure Does and Does Not Stop
Seizing the cloud infrastructure and the stolen recordings removes the campaign’s current tooling and a library of believable lures. It does not undo existing infections. Because the attackers often waited months before acting, some victims may still carry malware or have hijacked sessions that the seizure does not touch.
The operators remain at large, so the same playbook could resurface under new domains and accounts. No public indicators of compromise had been released in the DOJ announcement or press coverage as of November 13, 2026; the FBI’s FaceStealer resource page and FLASH report are the places to watch for them.
Spot Impersonation With SOCRadar Before the Call Starts
FaceStealer runs on trust signals that sit outside the corporate perimeter: hijacked social accounts, look-alike meeting pages and executives’ faces reused as bait. Here’s how SOCRadar can help:
- Brand Protection: helps teams detect fraudulent domains and impersonation profiles that use the company or its leaders’ identities
- Dark Web Monitoring: flags employee credentials that surface in stealer logs, which can be an early outside sign that an infection like this has occurred
- Cyber Threat Intelligence: follows Sapphire Sleet, BlueNoroff and related North Korean clusters as their lures change
What Should Crypto Firms and Developers Do Now?
- Verify every invitation out of band: Confirm a meeting request through a separate, known channel before joining, even when it comes from a familiar contact
- Join only through official clients: Use the installed Zoom or Teams application or the vendor’s own domain, and treat meeting pages on unfamiliar domains as hostile
- Never fix a call with a download or command: Do not install updates, run scripts or paste terminal commands that a caller or meeting page asks for
- Treat a suspicious call as an incident: If anything was installed or run, isolate the device, rotate credentials and wallet keys from a clean machine and revoke active sessions across messaging, email and exchange accounts
- Protect publishing rights: Open-source maintainers should require hardware-key MFA for package registries and source control, and use separate machines or profiles for release signing
- Report incidents: Victims in the U.S. can report to the FBI through IC3, which also helps investigators link new activity to the campaign
