FBI Seizes $1.2B in Stolen Crypto After Busting North Korean 'FaceStealer' Fake Video Call Scheme

How North Korean state hackers weaponized deepfake job interviews

Washington — November 12, 2026, 11:15 p.m. EST.

Federal law enforcement authorities pulled back the curtain Thursday on an elaborate cyber espionage and multi-million-dollar cryptocurrency heist operation, revealing that North Korean military hackers deployed artificial intelligence deepfakes, hijacked social profiles, and phony video job interviews to infiltrate digital asset firms across the globe.

In a coordinated announcement by the Federal Bureau of Investigation (FBI) and the Department of Justice (DOJ), officials confirmed the dismantling of server infrastructure supporting an 18-month social engineering campaign codenamed "FaceStealer." The operation was attributed to elite state-sponsored cyber units tracked by international intelligence services under monikers including Sapphire Sleet, UNC1069, and TraderTraitor—all operational arms of Pyongyang's Reconnaissance General Bureau.

The announcement coincided with court-authorized actions allowing federal prosecutors to restrain and seize over $1.2 billion in cryptocurrency assets tied to the record-breaking late-October intrusion against exchange giant Binance. Combined with parallel international efforts, authorities have now locked down more than $2.7 billion in illicit proceeds before they could be converted to fund North Korea's ballistic missile programs.

FBI Flash Alert: Threat actors associated with the DPRK are actively deploying sophisticated social engineering tactics against cryptocurrency and Web3 personnel, using fake video calls, AI-altered avatars, and deceptive technical support requests to deploy infostealers.
— FBI (@FBI) November 12, 2026

The 'FaceStealer' lure: Fake glitches, ClickFix traps, and stolen webcam feeds

According to investigative filings unsealed in federal court, the FaceStealer campaign was responsible for siphoning more than $400 million in digital assets from unsuspecting decentralized finance (DeFi) founders, blockchain protocol architects, and software engineers. The hackers demonstrated unprecedented patience and psychological manipulation to bypass standard two-factor authentication safeguards.

The attackers typically initiated contact by compromising established, verified accounts on LinkedIn, Telegram, Discord, and Slack belonging to prominent venture capitalists or recruiters. Targets were invited to discussions regarding lucrative advisory roles, executive hiring, or token listing agreements. Once a victim agreed to meet, hackers sent links to customized landing pages mimicking conferencing software like Zoom, Microsoft Teams, or Google Meet.

During the call, the attackers played high-resolution AI deepfakes or recycled webcam clips of genuine industry leaders who had been recorded in previous compromises. The hackers then staged a synthetic audio or video glitch. Under the guise of helping the victim fix their camera, the hackers instructed them to execute a terminal command or click an update link—employing an exploit known as a "ClickFix" trick. The action quietly downloaded remote access trojans (RATs) that harvested cryptographic private keys, browser session cookies, and hardware wallet credentials.

Federal agents executing search warrants against cloud hosting providers uncovered an astonishing library of intelligence: more than 900 covertly recorded webcam videos of industry professionals captured during these bogus interviews, which the regime had cataloged to manufacture future deepfake identities.

A $1.2 billion clawback and the global multi-agency freeze

Alongside the technical takedown of the FaceStealer infrastructure, the DOJ disclosed unprecedented progress in clawing back loot from the massive $6.3 billion cyber raid launched against Binance on October 31, 2026. Within days of that breach, blockchain intelligence investigators and federal cyber squads mapped the movement of stolen digital tokens across cross-chain bridges and privacy mixers.

Reporting by BBC News and The Block confirmed that the federal restraining order immobilizes roughly $1.2 billion in stablecoins and wrapped assets currently held across dozens of intermediary addresses. By working directly with stablecoin issuers and validator networks, law enforcement prevented the regime's money-laundering network from liquidating the tokens through OTC brokers in Southeast Asia.

Federal officials issued an urgent advisory urging all cryptocurrency developers and remote tech workers to verify unexpected meeting requests through independent out-of-band communication channels, disable automated browser terminal execution, and employ dedicated offline hardware signing devices for all treasury transactions.

Federal Bureau of Investigation Headquarters in Washington, D.C.

The red star marks the J. Edgar Hoover Building, headquarters of the Federal Bureau of Investigation on Pennsylvania Avenue NW in Washington, D.C., where the National Cyber Investigative Joint Task Force directed the international infrastructure takedown.

Map data: © OpenStreetMap contributors, ODbL.

Chronology of North Korean crypto targeting and federal enforcement

May 2025: North Korean state-sponsored hacking collective Sapphire Sleet initiates the FaceStealer cyber campaign, infiltrating Web3 developer networks.

September 2026: Threat actors expand operations, systematically recording target webcams during staged job interviews to generate training data for high-fidelity deepfakes.

October 31, 2026: Hackers compromise internal infrastructure at Binance, initiating an unauthorized drain of approximately $6.3 billion in digital assets.

November 4, 2026: The FBI Cyber Division and private analytics firms successfully trace and coordinate the freezing of an initial $1.5 billion in token transfers.

November 12, 2026: Federal prosecutors secure court orders seizing FaceStealer command-and-control servers, securing 900+ victim webcam recordings, and restraining an additional $1.2 billion in stolen crypto assets.