US Seizes Infrastructure Behind $400M North Korean Crypto Theft Ring

The U.S. government has seized the cloud infrastructure behind an 18-month North Korean social-engineering campaign that drained more than $400 million in cryptocurrency from companies and individuals across the crypto and Web3 sector. Federal investigators say the operation, tracked as 'FaceStealer,' also secretly recorded more than 900 webcam videos of deceived tech workers — footage that became ammunition for the next round of attacks.

The picture that emerges from this week's FBI alert is one of patient, layered deception. It started on platforms your employees already use every day: Telegram, LinkedIn, Slack, and Discord.

How did the attacks actually work?

According to the FBI, the North Korean threat actor hijacked legitimate accounts on those four platforms and used them to invite victims into video meetings under various pretexts. The cruel twist: while a target sat waiting for the call to start, the hacker was quietly recording their webcam. That recording was then shown to future victims — sometimes multiple clips of familiar people at once — to add social pressure and make the meeting look legitimate.

Then came the pivot. The attacker would claim a technical issue and display a fake error message, justifying the delivery of a malicious "fix." The victim followed a link promising an update or installer, and that's when the machine got infected.

The malware stole cryptocurrency data and account credentials for video meeting platforms including Zoom, Google Meet, and Microsoft Teams. It also gave the attackers access to victims' contact lists, social media accounts, communication apps, and stored webcam videos.

One detail deserves particular attention from security leaders: the FBI found attackers sometimes waited months — even more than a year — after the initial compromise before striking, likely letting the victim's cryptocurrency holdings grow first.

Who was in the crosshairs?

Researchers at Arctic Wolf attributed the FaceStealer campaign to the BlueNoroff hacker group, and their telemetry puts real scale on it: 677 identified targets across 58 countries, with a heavy focus on company founders and senior executives. Beyond fake video meetings, the group rotated through lures including financial documents, fake PDF viewer updates, identity verification prompts, and security audits — all engineered to get the target to run the "fix."

Huntress attributed a similar BlueNoroff campaign in 2025, where attackers used Zoom calls to infect company executives with custom macOS malware.

The supply chain was in scope too. The FBI bulletin highlighted one incident where hackers compromised the maintainer of a popular open-source JavaScript library — one with tens of millions of weekly downloads — after luring them into a fake Microsoft Teams meeting with multiple participants, including one person the developer recognized. Quick detection thwarted that attack, but the FBI confirmed multiple other attempts against developers in the npm and Rust crate ecosystems. Amazon threat analysts separately attributed several open-source supply chain attacks to BlueNoroff in a July 2026 report.

What does this change for security teams?

The FBI's guidance is blunt and practical:

• Join meetings only through official apps using an invite code — not browser links or scripts.
• Verify unexpected invitations independently, through a channel you already trust.
• Keep the webcam off unless it's explicitly needed.
• Never run scripts offered as fixes to technical problems.

For CISOs, the uncomfortable lesson is that the initial vector wasn't a zero-day. It was a hijacked Slack account, a familiar face on a paused video call, and a fake error message. Detection has to assume the meeting itself is the threat.

A second, bigger seizure

In a separate announcement, the U.S. Justice Department said that together with private sector companies it has frozen more than $2.7 billion connected to the 6.4 billion Binance crypto heist. The DoJ has already "obtained court-authorization to seize or restrain in excess of $1.2 billion of that amount."

Add the two figures together and U.S. authorities have moved against roughly $3.1 billion in stolen crypto assets in a single week.

The FaceStealer infrastructure is dark. The group behind it, by every indication, is not.