US DOJ seizes $1.2B tied to Binance theft and disrupts North Korean FaceStealer deepfake social engineering campaign
Matéria consolidada. Reúne 6 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 13/11/2026 12:05; os links antigos trazem para cá.
Fontes: gbhackers.com ↗ helpnetsecurity.com ↗ securityweek.com ↗ securityonline.info ↗ cyberscoop.com ↗
The US Department of Justice and the FBI announced coordinated actions against North Korean hacking groups on 13 November 2026. They include the dismantling of the cloud infrastructure behind the FaceStealer social engineering scheme (gbhackers.com) and the court-authorized seizure or restraint of more than $1.2 billion in assets stolen from Binance (cyberscoop.com, securityonline.info, securityweek.com). The FBI attributes the Binance theft, put at more than $6 billion (cyberscoop.com) or about $6.3 billion (securityweek.com), to the North Korean military hacking unit TraderTraitor. Government and private-sector efforts have frozen more than $2.7 billion of the stolen funds (cyberscoop.com, securityweek.com). FaceStealer has run for about 18 months and has drained more than $400 million from the cryptocurrency and Web3 sectors (cyberscoop.com, securityonline.info, securityweek.com, helpnetsecurity.com, gbhackers.com). Newer reports link the operators to Sapphire Sleet, APT38 and UNC1069 (helpnetsecurity.com, gbhackers.com). The actions aim to cut off illicit revenue that funds North Korea's weapons programs (securityonline.info, securityweek.com). An FBI alert accompanies the seizures; the sources say it lists wallet addresses for blocking, and gbhackers.com calls it a FLASH advisory.
Detalhes técnicos
- FaceStealer relies on impersonation through fake Zoom and Microsoft Teams interfaces to hijack accounts on Telegram, LinkedIn, Slack and Discord (cyberscoop.com, gbhackers.com).
- Attackers exploit victims using a library of more than 900 secretly recorded webcam videos (cyberscoop.com); helpnetsecurity.com describes the recordings as stolen from over 900 victims. The campaign is described as a deepfake scheme built on hijacked video calls (securityonline.info, securityweek.com).
- The fake calls are hosted on lookalike domains. The actors hijack a trusted contact's messaging account, invite the victim to a call and play recorded video of that acquaintance to build trust (helpnetsecurity.com, gbhackers.com).
- Targets include Web3 workers and open-source developers, who are tricked into installing malware that steals cryptocurrency and hijacks communication apps (securityonline.info).
- Victims are lured into running troubleshooting scripts sent during video calls (securityonline.info). The scripts install spyware and backdoors that enable theft of crypto wallets and credentials (helpnetsecurity.com). gbhackers.com lists cookie harvesters, keyloggers, screen capture tools and backdoors that enable long-term wallet thefts.
- The campaign also targeted maintainers of open-source JavaScript packages through fake Teams calls, aiming to insert malicious dependencies; early detection prevented compromise (gbhackers.com).
- The court authorization covers seizure or restraint of $1.2 billion of the Binance proceeds (securityweek.com). Recovery relies on court-ordered forfeiture claims and interdiction of stolen assets (securityweek.com).
Remediação
- Do not run troubleshooting scripts sent during video calls (securityonline.info); do not paste commands during meetings (gbhackers.com).
- Victims and platforms should block the wallet addresses listed in the FBI alerts (securityonline.info).
- Treat unexpected meeting links and call interfaces with caution, since fake Zoom and Teams pages are used to take over accounts (cyberscoop.com). Verify call hosts and use official app invitations (gbhackers.com).
- Verify invitations through multiple channels, watch for deepfake faces, safeguard webcam usage and protect wallet recovery phrases (helpnetsecurity.com).
- Secure wallets, enable multifactor authentication on messaging apps, warn contacts of suspected account hijacking and report incidents to IC3.gov (gbhackers.com).
- Users and exchanges should stay vigilant for phishing and deepfake social engineering associated with FaceStealer (securityweek.com).
Relatos divergentes
- Attribution of FaceStealer: securityonline.info attributes the campaign to North Korean APT38. helpnetsecurity.com links the actors to Sapphire Sleet and APT38, and gbhackers.com to Sapphire Sleet (APT38) and UNC1069, so the APT38 link is now supported by three sources. cyberscoop.com attributes the Binance theft to TraderTraitor and does not name a group for FaceStealer in the text provided; securityweek.com says only that the FBI attributes FaceStealer to North Korea. The sources differ on whether Sapphire Sleet and APT38 are one group or separate ones; gbhackers.com is the most recent.
- Size of the Binance theft: cyberscoop.com says more than $6 billion, gbhackers.com about $6 billion, and securityweek.com about $6.3 billion (the most specific figure).
- Frozen funds: cyberscoop.com and securityweek.com report more than $2.7 billion frozen. securityonline.info and helpnetsecurity.com do not mention it, and gbhackers.com says only that significant assets were frozen and seized without a figure.
- Nature of the $1.2B action: cyberscoop.com and securityonline.info describe a seizure, while securityweek.com says court authorization to seize or restrain the funds.
Linha do tempo
-
FBI Disrupts North Korean FaceStealer Campaign Linked to $400M Crypto Theft and Binance Heist
ler a análise desta fonte ocultar
The U.S. Justice Department and FBI have dismantled the cloud infrastructure behind FaceStealer, a North Korean state-sponsored social engineering campaign responsible for stealing over $400 million in cryptocurrency in the last 18 months. FaceStealer operators, linked to groups such as Sapphire Sleet (APT38) and UNC1069, hijacked legitimate Telegram, Slack, LinkedIn, and Discord accounts to trick contacts into joining fake video calls, where they employed stolen webcam footage to impersonate trusted colleagues. Victims were then socially engineered into executing malicious scripts that installed cookie harvesters, keyloggers, screen capture tools, and backdoors, facilitating long-term wallet thefts. The FBI’s FLASH advisory recommends verifying call hosts, using official app invitations, and refraining from pasting commands during meetings. In a parallel operation, the FBI attributes thefts of about $6 billion from Binance to the North Korean military-aligned threat actor TraderTraitor and has helped freeze and seize significant stolen assets. The campaign also targeted open-source JavaScript package maintainers via fake Teams calls to insert malicious dependencies, but early detection prevented compromise. Victims are urged to secure wallets, use multifactor authentication on messaging apps, warn contacts, and report incidents to IC3.gov.
-
North Korean hackers use stolen webcam videos in $400M fake Zoom call crypto thefts
ler a análise desta fonte ocultar
The FBI has revealed a sophisticated North Korean cybercrime operation named FaceStealer, where hackers use stolen webcam recordings of over 900 victims to lure cryptocurrency and web3 workers into fake Zoom and Teams calls. These calls, hosted on lookalike domains, impersonate trusted contacts by hijacking their messaging accounts and play recorded videos of acquaintances to establish trust. Victims are then tricked into running malicious scripts that install spyware and backdoors, which enable attackers to steal crypto wallets and credentials. The actors, linked to groups like Sapphire Sleet and APT38, have successfully stolen more than $400 million in cryptocurrency over 18 months. The FBI warns about deepfake faces and recommends safeguarding webcam usage, verifying invitations through multiple channels, and protecting wallet recovery phrases.
-
FBI Seizes $1.2 Billion of Cryptocurrency Stolen from Binance in Largest Crypto Heist Linked to North Korean Group TraderTraitor
ler a análise desta fonte ocultar
The FBI announced the seizure of more than $1.2 billion of cryptocurrency stolen in the historic $6.3 billion Binance hack, the largest crypto theft on record. The theft has been attributed to the North Korean hacking group known as TraderTraitor. Combined efforts by the U.S. government and private sector have frozen over $2.7 billion of stolen funds so far. In addition, the FBI attributed a separate $400 million cryptocurrency theft over 18 months to North Korea involving a social engineering scheme called FaceStealer that uses hijacked messaging apps and deepfake videos. These incidents reflect ongoing North Korean cybercrime campaigns funding the regime's illicit activities, including weapons programs.
Technical Details
The Binance hack involved the theft of about $6.3 billion in cryptocurrency and is attributed to the North Korean threat actor TraderTraitor. The U.S. Department of Justice has gained court authorization to seize or restrain $1.2 billion of this stolen cryptocurrency. The FaceStealer social engineering campaign combines hijacking popular messaging platforms and deepfake video technology to steal $400 million over 18 months. These operations demonstrate North Korea's use of advanced cyber tactics to generate illicit cryptocurrency revenue.
Remediation
Recovery efforts include court-ordered forfeiture claims and interdiction of stolen assets. The U.S. government and industry collaboration continue to freeze and seize illicit funds. Users and exchanges must remain vigilant for phishing and deepfake social engineering threats associated with campaigns like FaceStealer.
This remains a critical operational threat given the extent of funds involved and the affiliation with a nation-state actor conducting large-scale, ongoing cyber-enabled thefts.
-
US DOJ disrupts North Korean FaceStealer deepfake crypto theft and seizes $1.2B from Binance hack
ler a análise desta fonte ocultar
The US Department of Justice conducted coordinated operations to dismantle the North Korea FaceStealer scheme and to seize substantial digital assets linked to a recent Binance exchange breach. FaceStealer, a deepfake social engineering campaign attributed to North Korean APT38, exploited hijacked video calls over 18 months to trick Web3 workers and open-source developers into installing malware that stole over $400 million in cryptocurrency and hijacked communication apps. In parallel, authorities seized $1.2 billion from stolen assets tied to a $6 billion breach of Binance, attributed to North Korea's TraderTraitor military unit. These disruptive actions aim to cut off illicit cryptocurrency revenue streams that fund North Korea’s weapons programs. Victims and platforms are urged to avoid running troubleshooting scripts sent during video calls and to block wallet addresses listed in FBI alerts.
-
US seizes North Korean hacking infrastructure and $1.2 billion in Binance theft linked to FaceStealer social engineering
ler a análise desta fonte ocultar
The US Justice Department announced coordinated actions against North Korean hacking groups responsible for stealing billions in cryptocurrency, including the seizure of cloud infrastructure behind the FaceStealer social engineering scheme and the court-authorized seizure of over $1.2 billion stolen from Binance. The FBI attributes the theft of more than $6 billion in virtual assets from Binance to the North Korean military hacking group TraderTraitor and has frozen about $2.7 billion of the stolen funds. The FaceStealer campaign uses sophisticated impersonation via fake Zoom and Microsoft Teams interfaces to hijack accounts on platforms like Telegram, LinkedIn, Slack, and Discord, exploiting victims through a library of over 900 secretly recorded webcam videos. This ongoing campaign has drained over $400 million from cryptocurrency and Web3 sectors in the past 18 months. The FBI alert and seizure highlight the complexity and scale of North Korea's evolving tactics in cryptocurrency theft and cybercrime funding.