US DOJ seizes $1.2B tied to Binance theft and disrupts North Korean FaceStealer deepfake social engineering campaign

Linha do tempo

1. securityaffairs.com ↗ · pub. 13/11/2026 18:19 · coletado 13/11 20:00

   US DOJ Seizes $1.2 Billion and Disrupts North Korea's Cryptocurrency Theft Infrastructure

   ler a análise desta fonte ocultar

   The U.S. Department of Justice (DOJ), in coordination with the FBI and other agencies, announced significant actions against North Korea's cryptocurrency theft operations. These include the seizure of over $1.2 billion stolen from Binance on October 29 by the group known as TraderTraitor, as well as the disruption of infrastructure used in the FaceStealer social engineering campaign responsible for over $400 million in crypto theft. FaceStealer uses sophisticated tactics such as deepfake videos and fake technical issues during meetings to install malware and compromise victims, including open-source software developers. The DOJ and FBI have published detailed reports and resources to help victims and the community protect against such scams. TraderTraitor continues laundering stolen assets via cryptocurrency bridges, mixers, and exchanges, and law enforcement urges Virtual Asset Service Providers (VASPs) to block related transactions. These actions reflect ongoing efforts to combat North Korea's use of illicit crypto theft to fund its weapons programs.

2. thehackernews.com ↗ · pub. 13/11/2026 11:28 · coletado 13/11 13:00

   FBI attributes $400M cryptocurrency theft to North Korean deepfake video social engineering campaign FaceStealer

   ler a análise desta fonte ocultar

   The FBI has linked North Korean threat actors, specifically the BlueNoroff group, to a sophisticated social engineering campaign called FaceStealer, which has stolen over $400 million in cryptocurrency in the past 18 months. This campaign uses deepfake and prerecorded videos of trusted contacts during fraudulent video meetings to deceive targets, primarily individuals in the cryptocurrency and Web3 sectors. Victims are tricked into executing malware disguised as technical fixes, enabling attackers to steal cryptocurrency and infiltrate further systems. The attackers exploit compromised social media and communication accounts, leveraging generative AI techniques to enhance deepfake authenticity, which escalate their targeting of high-value individuals such as CEOs, founders, and developers. The FBI has seized more than 900 victim webcam videos, and the U.S. Department of Justice has also recovered over $1.2 billion related to North Korean cryptocurrency thefts, which fund illicit weapons programs. Additionally, related campaigns including Contagious Interview utilize trojanized coding tests and fake recruiter personas to deploy malware on developers' devices, contributing to supply chain threats.

3. hackread.com ↗ · pub. 13/11/2026 11:17 · coletado 13/11 12:02

   FBI disrupts North Korean FaceStealer scheme behind $400M crypto theft via hijacked meetings and fake videos

   ler a análise desta fonte ocultar

   The FBI and DOJ have disrupted a North Korean cyberattack campaign named FaceStealer, responsible for stealing over $400 million in cryptocurrency over 18 months. The attackers, linked to groups like UNC1069 and APT38, hijack messaging accounts on platforms such as Telegram, Slack, LinkedIn, and Discord to invite targets to fake Zoom or Teams meetings. These meetings use prerecorded webcam footage and fabricated participants to convince victims to execute malicious commands, installing malware that steals browser cookies, logs keystrokes, captures screenshots, and grants persistent access. They often wait months before stealing cryptocurrency while monitoring wallets. The campaign also targets open-source software maintainers, attempting to insert malicious dependencies into widely used libraries. FBI seized over 900 webcam videos and reports emerging use of AI-generated videos to impersonate individuals in the cryptocurrency sector. This campaign reflects a broader trend of North Korean attacks targeting cryptocurrency and software supply chains.

4. gbhackers.com ↗ · pub. 13/11/2026 09:14 · coletado 13/11 10:00

   FBI Disrupts North Korean FaceStealer Campaign Linked to $400M Crypto Theft and Binance Heist

   ler a análise desta fonte ocultar

   The U.S. Justice Department and FBI have dismantled the cloud infrastructure behind FaceStealer, a North Korean state-sponsored social engineering campaign responsible for stealing over $400 million in cryptocurrency in the last 18 months. FaceStealer operators, linked to groups such as Sapphire Sleet (APT38) and UNC1069, hijacked legitimate Telegram, Slack, LinkedIn, and Discord accounts to trick contacts into joining fake video calls, where they employed stolen webcam footage to impersonate trusted colleagues. Victims were then socially engineered into executing malicious scripts that installed cookie harvesters, keyloggers, screen capture tools, and backdoors, facilitating long-term wallet thefts. The FBI’s FLASH advisory recommends verifying call hosts, using official app invitations, and refraining from pasting commands during meetings. In a parallel operation, the FBI attributes thefts of about $6 billion from Binance to the North Korean military-aligned threat actor TraderTraitor and has helped freeze and seize significant stolen assets. The campaign also targeted open-source JavaScript package maintainers via fake Teams calls to insert malicious dependencies, but early detection prevented compromise. Victims are urged to secure wallets, use multifactor authentication on messaging apps, warn contacts, and report incidents to IC3.gov.

5. helpnetsecurity.com ↗ · pub. 13/11/2026 03:30 · coletado 13/11 04:01

   North Korean hackers use stolen webcam videos in $400M fake Zoom call crypto thefts

   ler a análise desta fonte ocultar

   The FBI has revealed a sophisticated North Korean cybercrime operation named FaceStealer, where hackers use stolen webcam recordings of over 900 victims to lure cryptocurrency and web3 workers into fake Zoom and Teams calls. These calls, hosted on lookalike domains, impersonate trusted contacts by hijacking their messaging accounts and play recorded videos of acquaintances to establish trust. Victims are then tricked into running malicious scripts that install spyware and backdoors, which enable attackers to steal crypto wallets and credentials. The actors, linked to groups like Sapphire Sleet and APT38, have successfully stolen more than $400 million in cryptocurrency over 18 months. The FBI warns about deepfake faces and recommends safeguarding webcam usage, verifying invitations through multiple channels, and protecting wallet recovery phrases.

6. securityweek.com ↗ · pub. 12/11/2026 23:28 · coletado 13/11 01:00

   FBI Seizes $1.2 Billion of Cryptocurrency Stolen from Binance in Largest Crypto Heist Linked to North Korean Group TraderTraitor

   ler a análise desta fonte ocultar

   The FBI announced the seizure of more than $1.2 billion of cryptocurrency stolen in the historic $6.3 billion Binance hack, the largest crypto theft on record. The theft has been attributed to the North Korean hacking group known as TraderTraitor. Combined efforts by the U.S. government and private sector have frozen over $2.7 billion of stolen funds so far. In addition, the FBI attributed a separate $400 million cryptocurrency theft over 18 months to North Korea involving a social engineering scheme called FaceStealer that uses hijacked messaging apps and deepfake videos. These incidents reflect ongoing North Korean cybercrime campaigns funding the regime's illicit activities, including weapons programs.

   Technical Details

   The Binance hack involved the theft of about $6.3 billion in cryptocurrency and is attributed to the North Korean threat actor TraderTraitor. The U.S. Department of Justice has gained court authorization to seize or restrain $1.2 billion of this stolen cryptocurrency. The FaceStealer social engineering campaign combines hijacking popular messaging platforms and deepfake video technology to steal $400 million over 18 months. These operations demonstrate North Korea's use of advanced cyber tactics to generate illicit cryptocurrency revenue.

   Remediation

   Recovery efforts include court-ordered forfeiture claims and interdiction of stolen assets. The U.S. government and industry collaboration continue to freeze and seize illicit funds. Users and exchanges must remain vigilant for phishing and deepfake social engineering threats associated with campaigns like FaceStealer.

   This remains a critical operational threat given the extent of funds involved and the affiliation with a nation-state actor conducting large-scale, ongoing cyber-enabled thefts.

7. securityonline.info ↗ · pub. 12/11/2026 22:43 · coletado 12/11 23:00

   US DOJ disrupts North Korean FaceStealer deepfake crypto theft and seizes $1.2B from Binance hack

   ler a análise desta fonte ocultar

   The US Department of Justice conducted coordinated operations to dismantle the North Korea FaceStealer scheme and to seize substantial digital assets linked to a recent Binance exchange breach. FaceStealer, a deepfake social engineering campaign attributed to North Korean APT38, exploited hijacked video calls over 18 months to trick Web3 workers and open-source developers into installing malware that stole over $400 million in cryptocurrency and hijacked communication apps. In parallel, authorities seized $1.2 billion from stolen assets tied to a $6 billion breach of Binance, attributed to North Korea's TraderTraitor military unit. These disruptive actions aim to cut off illicit cryptocurrency revenue streams that fund North Korea’s weapons programs. Victims and platforms are urged to avoid running troubleshooting scripts sent during video calls and to block wallet addresses listed in FBI alerts.

8. cyberscoop.com ↗ · pub. 12/11/2026 21:32 · coletado 12/11 22:00 primeiro registro

   US seizes North Korean hacking infrastructure and $1.2 billion in Binance theft linked to FaceStealer social engineering

   ler a análise desta fonte ocultar

   The US Justice Department announced coordinated actions against North Korean hacking groups responsible for stealing billions in cryptocurrency, including the seizure of cloud infrastructure behind the FaceStealer social engineering scheme and the court-authorized seizure of over $1.2 billion stolen from Binance. The FBI attributes the theft of more than $6 billion in virtual assets from Binance to the North Korean military hacking group TraderTraitor and has frozen about $2.7 billion of the stolen funds. The FaceStealer campaign uses sophisticated impersonation via fake Zoom and Microsoft Teams interfaces to hijack accounts on platforms like Telegram, LinkedIn, Slack, and Discord, exploiting victims through a library of over 900 secretly recorded webcam videos. This ongoing campaign has drained over $400 million from cryptocurrency and Web3 sectors in the past 18 months. The FBI alert and seizure highlight the complexity and scale of North Korea's evolving tactics in cryptocurrency theft and cybercrime funding.