US prosecutors seize North Korea-linked infrastructure in $400M video-call crypto scam

what happened

American authorities have shut down cloud servers that supported FaceStealer, a social-engineering operation linked to North Korea. According to Crypto Briefing, the FBI and the Justice Department made these actions public between 10 and 12 November 2026. Several state-backed hacking groups were targeted, including those tracked as Sapphire Sleet, UNC1069, Stardust Chollima, APT38 and BlueNoroff.

Investigators recovered more than 900 webcam recordings captured secretly during fake video calls. Most victims worked in crypto and Web3, and open-source software maintainers were also hit. Alongside this, the Justice Department froze over $1.2 billion in digital assets it tied to North Korean actors and the Binance theft. An earlier $2.8 billion had already been frozen. Crypto Briefing reports that the Binance theft, attributed to North Korean groups on 29 October 2026, exceeds $6 billion.

The roughly $400 million linked to FaceStealer over 18 months is a separate figure, unrelated to the Binance incident.

why it matters

The scheme did not require breaking any encryption; it exploited trust in what people saw on a video call. For markets, the size of the frozen funds and the state attribution add pressure on exchanges and crypto firms to tighten security and compliance, though the news does not directly alter bitcoin supply or demand.

market impact

Crypto exchanges and the crypto market: heightened security and compliance scrutiny after large state-linked thefts

tags

instruments