Justice Department seizes North Korea's FaceStealer servers, saying fake video calls stole over $400 million
The calls come from a friend's real account, and the face on screen can be a recording or a deepfake.
The Justice Department said on November 12, 2026, that it had seized cloud servers behind FaceStealer, a North Korean scheme the FBI says has stolen more than $400 million in cryptocurrency over the last 18 months. Agents also seized more than 900 webcam videos of the people it targeted.
FaceStealer works through video calls that look like they come from someone you know. The department's release says the hackers also use AI to make deepfake videos of well-known people in crypto, and drop them into those calls.
- Scheme
- FaceStealer
- Attributed to
- North Korean hackers known as Sapphire Sleet, UNC1069 and BlueNoroff
- Stolen
- more than $400 million in the last 18 months
- Seized
- cloud-based infrastructure and over 900 webcam videos
- Led by
- the Central District of California and the FBI's Los Angeles Field Office
How the trick works
It starts with an account that's already been stolen. The hackers send a meeting invitation from it to the victim's contacts, so the invite comes from a real colleague or friend.
Once the target joins, the hackers record their webcam and play back footage of earlier victims the target knows. It looks like trusted people are on the call. Then comes a fake technical fault (the release's example is being told you can't be heard) and a link to fix it. That "fix" installs malware.
The AI part is the deepfakes. The department's word for it is "super intelligence (SI)," and it says the hackers use it to make videos of influential people in crypto and Web3, which makes the scheme even more effective. Patrick Grandy, who runs the FBI's Los Angeles office, put it bluntly.
If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough.
The release also says the hackers sometimes waited. In several cases they stole cryptocurrency or took over accounts from several months to more than a year after they first got in.
Why open-source developers should care
Crypto workers were the first targets. The FBI says that's changing: the same group is now going after people who write and maintain open-source software, to get into their machines and the code repositories they control.
That's a bigger problem than one stolen wallet. The FBI's FaceStealer page says the goal is the software supply chain, and that malicious code slipped in through a trusted maintainer could reach millions of downstream users. Most people never see the developers behind the apps and libraries they rely on, so a compromise there travels a long way before anyone notices.
I read the FBI's five-step outline of the scheme, and only the last step involves the new target doing anything wrong: they run the "fix." Everything before that is built to look normal.
The Binance money
The same release covers a separate theft. On or about October 29, the department says, North Korean military hackers the FBI calls TraderTraitor stole more than $6 billion in virtual assets from the Binance exchange. More than $2.7 billion of it has been frozen so far, and the department has court approval to seize or restrain more than $1.2 billion.
FBI Los Angeles posted its own warning on X the same afternoon. The FBI says victims can report suspected FaceStealer activity at IC3.gov, and it has put its resources in one place at fbi.gov/facestealer.
More on Security
- Notion says Fireworks AI kept chats it had promised not to store, and attackers reached themNovember 12, 2026
- Claroc finds 35,578 Grok-built apps open to anyone, including SpaceXSI's own sales dataNovember 11, 2026
- Railway says an attacker hunting AI keys ran up an estimated $740,000 on stolen credentialsNovember 11, 2026
- Google DeepMind says its AI agents formally verified Signal's encryption code in four weeksNovember 10, 2026
