The operation went after several state-sponsored hacking groups linked to North Korea. They are tracked under the names Sapphire Sleet, UNC1069, Stardust Chollima, APT38 and BlueNoroff.
Investigators seized more than 900 webcam videos that had been secretly recorded from victims. The recordings were tied to fraudulent video-conferencing sessions used in the scheme.
Most of those victims worked in crypto and Web3. The targets also included maintainers of open-source software.
The Binance money trail
The FaceStealer disruption came alongside a larger asset freeze. The DOJ froze more than $1.2 billion in digital assets that it linked to North Korean actors and to the theft from Binance.
On October 29, 2026, the Binance theft was attributed to North Korean groups. The total taken came to more than $6 billion.
The freezes have arrived in stages. An estimated $2.8 billion was frozen first, and the latest actions added the further $1.2 billion.
The $400 million credited to FaceStealer is a separate number. It reflects thefts linked to the video-call scheme over 18 months, not the Binance incident.
Why social engineering keeps working
FaceStealer did not need to break any cryptography. It relied on people trusting what they saw on a video call.
More than 900 recorded victims is a sobering count. Each recording stands for at least one moment when someone thought they were simply taking a meeting.
cryptobriefing.com
