Summary
The US Justice Department and FBI announced two separate actions against North Korea-linked cryptocurrency theft on November 12, 2026. One is a court-authorized seizure or restraint of more than $1.2 billion stolen from Binance. The other is a disruption of cloud infrastructure behind a social engineering campaign, which the FBI calls FaceStealer, that has stolen more than $400 million over 18 months.
The Binance Seizure
According to The Record, North Korean actors stole about $6.3 billion from Binance last month. Binance and the FBI blamed TraderTraitor, described as North Korea's leading crypto-theft group.
| Item | Detail |
|---|---|
| Seized or restrained | More than $1.2 billion |
| Frozen across platforms | About $2.7 billion in total |
| Attributed to | TraderTraitor |
| Status | Tracing and forfeiture ongoing |
DOJ says TraderTraitor keeps laundering assets through bridges, mixers and exchanges. Elliptic reports launderers create worthless tokens and move funds through decentralized exchange liquidity pools, avoiding direct wallet-to-wallet transfers. Elliptic notes North Korea used a similar technique after the $1.4 billion Bybit theft in 2025. FBI officials say proceeds fund the country's weapons program.
FaceStealer: Fake Meetings, Real Malware
The FBI attributed FaceStealer to APT38, the group linked to the 2016 Bank of Bangladesh heist. Investigators obtained a warrant to seize more than 900 webcam videos of victims.
The attack chain, as described:
- The target receives a Calendly invite to a Zoom or Teams meeting, sometimes from an account the attackers already compromised.
- The link leads to a fake domain that installs malware before the meeting.
- Pre-recorded videos of earlier victims, and sometimes deepfakes of well-known crypto figures, simulate a crowded call.
- A staged audio problem prompts the target to run a "fix" that installs a cookie harvester, keylogger, screen capturer and backdoor.
- Attackers then hijack Telegram, LinkedIn, Slack and Discord accounts to message the victim's contacts, sometimes months later, using stolen chat history to tailor lures.
Targets include the crypto industry and open-source developers. The FBI cited attempts against maintainers on the NPM and Rust crates registries, and said one significant JavaScript library maintainer was nearly lured into a fake Teams call this year.
The FBI said it was unclear whether FaceStealer played a role in the Binance theft.
Defensive Takeaways
The reporting contains no formal FBI guidance; these points follow from the attack chain:
- Treat unexpected meeting invitations as suspect, even from known contacts, and confirm through a separate channel.
- Never install or run software to "fix" audio or video during a call.
- Use hardware-backed MFA and session protections so stolen browser cookies are less useful.
- Maintainers of package registries accounts should isolate publishing credentials from daily-use browsers.
- Warn contacts quickly if an account is hijacked, since follow-on lures reuse trusted relationships.
Sources
- The Record, "Feds announce seizure of $1.2 billion from Binance theft; also takedown of 'FaceStealer' tools"
- SecurityWeek and CyberScoop coverage of the same announcements