North Korea Crypto Theft: US Seizes $1.2bn, Flags Deepfake Scam
US prosecutors have frozen more than $1.2bn in digital assets and seized the cloud infrastructure behind a North Korean deepfake fraud, in one of the largest coordinated strikes yet against North Korea's crypto theft operations. The US Department of Justice said on 12 November 2026 that the action hit two separate Pyongyang schemes: a social engineering operation the FBI has named "FaceStealer," which has drained more than $400m from crypto holders in 18 months, and the laundering of roughly $6bn stolen from the exchange Binance in late October.
For anyone holding, custodying or building digital assets, the significance is less about the dollar figures recovered and more about the method. The FBI is warning that the scam is sophisticated enough to deceive experienced, security-conscious users, and that its targets now include the open-source developers whose code underpins much of the crypto economy.
What did the Justice Department actually seize?
Two things, running on separate tracks. The US Attorney's Office for the Central District of California disrupted the cloud infrastructure powering the FaceStealer campaign, and under a federal warrant the FBI recovered more than 900 webcam videos of victims captured during the scheme.
Separately, in the Binance case, the US Attorney's Office for the District of Columbia and the department's national security and cyber units have so far helped freeze more than $2.7bn of the stolen assets, of which the department has obtained court authorisation to seize or restrain in excess of $1.2bn. Officials credited the speed of the response for halting roughly half the breach before the funds moved beyond reach.
How does the FaceStealer deepfake scam work?
It weaponises trust in video calls. North Korean operators, tracked under names including Sapphire Sleet, BlueNoroff and APT38, invite targets to a video meeting using an account stolen from an earlier victim. Once the target joins, the attackers record their webcam feed and play back pre-recorded footage of people the target knows, simulating the presence of trusted colleagues.
The crews also deploy AI-generated deepfake videos of well-known figures in the crypto and Web3 industries to make the meeting more convincing. The DOJ described the capability as "super intelligence-enabled." Mid-call, the attackers stage a fake technical fault, such as claiming the target cannot be heard, and supply a link to "fix" it. The fix installs malware. In several cases, the operators waited months, sometimes more than a year, before draining wallets or hijacking accounts, and used the victim's own contacts to reach new targets.
Why are open-source developers now a target?
Because compromising one maintainer can poison software used by thousands. The FBI says the operators have increasingly aimed FaceStealer at people who build and maintain open-source software, seeking access to their devices and the code repository accounts they control. That targeting points to supply-chain attacks, where malicious code is planted upstream and inherited by every downstream project that depends on it. For a sector built on shared libraries and public repositories, that shifts the threat from individual loss to systemic risk.
How big is the Binance theft compared with past hacks?
If the roughly $6bn figure holds, it would be the largest single crypto theft on record by a wide margin. The previous benchmark was the February 2025 Bybit breach, in which North Korea's Lazarus Group stole about $1.5bn in Ethereum, described at the time as the biggest heist in the industry's history. The Binance theft, attributed by the FBI to a North Korean military unit it calls TraderTraitor, would be roughly four times that.
It also fits a documented trend. Blockchain analytics firm Chainalysis attributed about $2bn of crypto theft to North Korea-linked actors across the whole of 2025, out of some $3.4bn stolen globally. A single breach now rivals an entire record year. Investigators at the FBI, US Secret Service and IRS Criminal Investigation say TraderTraitor is still actively laundering the proceeds through bridges, mixers and exchanges, and have urged virtual asset service providers to block linked addresses.
What should crypto and Web3 professionals do now?
Treat unexpected "technical fixes" on video calls as hostile, however familiar the faces on screen. The FBI has published a dedicated resource at fbi.gov/facestealer with best practices and steps for anyone who suspects a compromise. The practical defences are unglamorous: never install software prompted mid-meeting, verify meeting invitations through a second channel, and assume that a convincing face on a call can now be synthetic.
Why This Matters to FinanceX Readers
The headline numbers confirm what the data already showed: state-sponsored crypto theft has become an industrial funding stream, and the attack surface has moved from exchange infrastructure to the individuals and developers around it. For investors, custodians and fintech operators, the exposure is no longer only your own security stack, but the trustworthiness of every video call, software dependency and counterparty in the chain. Deepfake-enabled social engineering turns human verification, long the backstop when technical controls fail, into the weak point. The firms that treat identity verification and supply-chain provenance as board-level risks, rather than IT housekeeping, are the ones positioned to stay out of the next seizure notice.
