Key Highlights
- FaceStealer targeted crypto, Web3 and open-source software communities through fraudulent video-conferencing sessions.
- Investigators seized more than 900 webcam recordings secretly captured from victims.
- The U.S. Department of Justice froze more than $1.2 billion in digital assets linked to North Korean actors and the Binance theft.
FaceStealer Operation Targeted North Korean Hacking Groups
An international disruption operation targeted several state-sponsored hacking groups linked to North Korea, including Sapphire Sleet, UNC1069, Stardust Chollima, APT38 and BlueNoroff. Investigators seized more than 900 webcam videos that had been secretly recorded from victims during fraudulent video-conferencing sessions used in the scheme.
Most of the victims worked in cryptocurrency and Web3. The campaign also targeted maintainers of open-source software, indicating that the operation focused on people and organizations with access to valuable digital assets, technical infrastructure or trusted software communities.
Digital Asset Freezes Include Binance-Linked Funds
The disruption of FaceStealer came alongside a wider asset-freezing effort by the U.S. Department of Justice. Authorities froze more than $1.2 billion in digital assets linked to North Korean actors and the theft from Binance.
On October 29, 2026, the Binance theft was attributed to North Korean groups. The total amount stolen exceeded $6 billion. The asset freezes have taken place in stages: an estimated $2.8 billion was frozen initially, while the latest actions added a further $1.2 billion.
The $400 million associated with FaceStealer is a separate figure. It represents thefts connected to the video-call scheme over an 18-month period and does not refer to the Binance incident.
Why Social Engineering Remains Effective
FaceStealer did not rely on breaking cryptographic protections. Instead, it exploited victims’ trust in what appeared to be legitimate video calls. The approach shows how social engineering can bypass technical defenses by persuading people to participate in seemingly routine meetings or interactions.
More than 900 recorded victims represents a significant measure of the campaign’s reach. Each recording reflects at least one occasion when a victim believed they were simply joining a meeting, while the attackers secretly captured video as part of the wider scheme.
Why This Matters
The FaceStealer operation highlights the continuing risk faced by cryptocurrency, Web3 and open-source software communities from North Korean-linked cyber groups. The case also underscores that major digital-asset thefts can involve both large-scale technical operations and direct manipulation of individual targets through trusted communication channels.
The separate accounting for the $400 million FaceStealer losses, the more than $6 billion Binance theft and the staged asset freezes is significant because it distinguishes multiple parts of the broader enforcement effort. The latest actions add to earlier freezes and show that authorities are pursuing digital assets tied to North Korean actors over time.
Frequently Asked Questions
Which groups were targeted in the FaceStealer operation?
The operation targeted Sapphire Sleet, UNC1069, Stardust Chollima, APT38 and BlueNoroff, all of which are linked to North Korea.
How many webcam recordings did investigators seize?
Investigators seized more than 900 webcam videos secretly recorded from victims during fraudulent video-conferencing sessions.
How is the FaceStealer amount different from the Binance theft?
The $400 million figure relates to thefts linked to the FaceStealer video-call scheme over 18 months. It is separate from the more than $6 billion stolen from Binance and attributed to North Korean groups on October 29, 2026.
