TLDR
- The DOJ seized cloud systems used in North Korea’s FaceStealer scam, which the FBI says stole over $400 million in crypto in 18 months.
- Agents took more than 900 webcam videos that the attackers collected from victims.
- Hackers used recordings and AI deepfakes of people victims knew to lure them onto fake video calls.
- A court approved the seizure or restraint of more than $1.2 billion stolen in the Binance hack.
- More than $2.7 billion of the funds stolen from Binance has been frozen so far.
The U.S. Justice Department said it has seized cloud systems used in a North Korean scheme built around fake video calls. The FBI calls the campaign FaceStealer. The department announced the action on Thursday.
BREAKING: 🇺🇸 DOJ just seized $1.2 Billion in crypto stolen by North Korea, tied to the $6.3 Billion Binance hack. pic.twitter.com/AuSfssEXLP
— Ash Crypto (@AshCrypto) November 12, 2026
The FBI says the scheme has stolen more than $400 million in crypto over the past 18 months. Agents also seized more than 900 webcam videos collected by the attackers. The FBI has issued guidance for people affected by the scheme.
How the Fake Video Call Scheme Works
Hackers use stolen accounts to invite victims to video meetings. The meetings are made to look like Zoom or Microsoft Teams calls. Victims believe they are talking with someone they trust.
On the call, the victim sees a recording or a deepfake of a familiar person. The recordings come from webcam footage taken from earlier victims. The FBI says the hackers increasingly use AI-generated deepfake videos.
Once the victim joins, the hackers claim there is a technical problem. They tell the victim to install software or run a command to fix it. The steps are a trick.
The instructions install malware on the victim’s computer. The malware can steal crypto and give the attackers access to other systems. The DOJ said this puts both money and data at risk.
In some cases, the takeover of communication accounts came months to more than a year after the first computer was compromised. This means the hackers did not always act right away. They sometimes waited before using the stolen access.
The hackers also used stolen contacts and accounts to reach more people. Their targets included developers who maintain widely used open-source software. The FBI warned that compromising a developer could let hackers gain access through that person’s software.
Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office, described the scheme in a statement. He said it “exploits our trust in ubiquitous video conference platforms and valued personal relationships.” He added that people who cannot imagine falling for it are not thinking creatively enough.
Court Approves Seizure of Binance Funds
In a separate action, the DOJ received court approval to seize or restrain more than $1.2 billion stolen from crypto exchange Binance. The funds are part of more than $2.7 billion frozen by U.S. authorities and private companies. The stolen total is more than $6 billion.
The department attributed the Binance hack to TraderTraitor, a North Korean military-linked hacking group. The group stole the funds from the exchange around Oct. 29, according to the DOJ. The FBI made the same attribution.
Investigators are still tracing the stolen assets. The hackers are moving the funds through blockchain bridges, mixers and exchanges, the DOJ said. Authorities are trying to freeze and recover more of the money.
M. Scott Proctor, principal deputy assistant attorney general for national security, said North Korea’s government pays for its weapons program through crypto theft. He said the National Security Division will use every tool at its disposal to seize and return the stolen funds.
Binance has put its losses at about $6.3 billion and set aside $6.34 billion in company funds to cover them. Earlier Thursday, the exchange said it has completed coverage of the assets affected in the hack. It also published a new proof of reserves snapshot.
