The US Department of Justice announced Thursday two major coordinated enforcement actions targeting North Korean state-sponsored cryptocurrency theft. Federal authorities seized cloud infrastructure behind the "FaceStealer" social engineering campaign, which stole more than $400 million over the past 18 months; prosecutors obtained court authorization to seize and restrain more than $1.2 billion stolen from the Binance cryptocurrency exchange.
According to DOJ Press Release 26-1356, the FaceStealer disruption was led by the US Attorney's Office for the Central District of California and the FBI Los Angeles Field Office; North Korean threat groups—known publicly as APT38, BlueNoroff, and Sapphire Sleet—lured victims into video conferences using hijacked accounts belonging to trusted contacts; hackers played prerecorded footage or AI-generated deepfake videos of prominent industry figures to establish immediate credibility. Under federal warrants, the FBI seized over 900 webcam recordings of FaceStealer victims and launched an informational hub warning software maintainers about social engineering threats.
The Justice Department detailed rapid interdiction efforts following the October 29 breach of Binance; federal investigators attributed the theft of more than $6 billion in virtual assets—reported by some financial outlets near $6.34 billion—to North Korean military hackers tracked as TraderTraitor; working closely with private virtual asset service providers, US authorities and industry partners froze over $2.7 billion globally. Of those frozen funds, federal prosecutors secured court orders to seize or restrain more than $1.2 billion; Assistant Attorney General A. Tysen Duva noted that law enforcement swiftly prevented nearly half of the historic breach from slipping beyond judicial reach.
Industry tracking cited by financial media indicates North Korean hackers have stolen $7.4 billion in cryptocurrency so far in 2026, accounting for 85 percent of all global crypto thefts this year; investigators identified more than 20,000 laundering wallets tied to Pyongyang's ongoing operations.
