US seizes infrastructure behind North Korea’s $400 million fake video call scam

US authorities have seized cloud infrastructure used in FaceStealer, a North Korean video call scheme the FBI says stole more than $400 million in cryptocurrency over 18 months. The Justice Department announced the action on November 12, 2026, along with a warrant to seize more than 900 webcam recordings of victims.

Crypto scam turned familiar faces into convincing bait

According to the Justice Department, FaceStealer operators sent meeting invitations from accounts they had taken over from previous victims.

Once a target joined a call, the attackers recorded the person’s webcam footage. They also played prerecorded video of someone the target knew, creating the impression that a trusted contact was participating.

The FBI said the hackers were beginning to use AI-generated deepfakes of prominent cryptocurrency figures as well.

The crypto scam combined those familiar-looking participants with a staged technical problem. Attackers would claim something had gone wrong during the meeting and offer a link supposedly intended to resolve it.

Instead, the link installed malware, according to the department. The invitation and video interaction provided a convincing setting for persuading targets to run malicious software.

The attackers did not always steal funds immediately. In some cases, they waited months or more than a year before taking cryptocurrency, extending the interval between the initial compromise and the financial loss.

After compromising a victim, the operators used that person’s contacts to identify further targets. The crypto scam could therefore spread through professional relationships, with each captured account providing another route to potential victims.

FBI recovers more than 900 victim webcam recordings

Acting under a federal warrant, the FBI seized more than 900 webcam videos of victims.

Those recordings formed part of an operation built around impersonation and trust. The reported total does not establish that every recorded person suffered a financial loss, and the supplied account does not give a complete victim count.

Patrick Grandy, who heads the FBI’s Los Angeles field office, warned against assuming the deception would be easy to recognise.

“If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” Grandy said.

Most targets of the crypto scam worked in cryptocurrency or other internet-related fields. The Justice Department said attackers were increasingly pursuing open-source software developers, apparently seeking opportunities for supply-chain attacks.

That targeting raises concerns beyond the immediate theft of digital assets. Access to a developer’s accounts or systems could potentially provide a route to compromise software used by others, although the report did not identify a completed supply-chain attack arising from these cases.

Crypto scam attribution differs from Binance hacking group

The FBI links FaceStealer to a hacking cluster known as Sapphire Sleet or UNC1069.

Officials distinguish that group from TraderTraitor, the North Korean military hackers blamed for stealing more than $6 billion from Binance on or around October 29.

That separation matters when interpreting the announcements. The $400 million attributed to the crypto scam concerns an 18-month campaign involving deceptive meetings. The Binance losses concern a separate exchange heist.

The Associated Press put the Binance theft at approximately $6.3 billion and described it as the largest cryptocurrency heist on record.

North Korea has denied involvement in the Binance attack. The U.S. allegations nevertheless place both cases within a wider concern about cryptocurrency theft supporting the country’s government.

“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, the Justice Department’s principal deputy assistant attorney general for national security.

Binance asset action remains distinct from victim repayment

Alongside the crypto scam disruption, authorities are pursuing legal measures against funds associated with the Binance theft.

The Justice Department said U.S. agencies and private companies had frozen more than $2.7 billion linked to that incident. It separately announced court approval to seize or restrain more than $1.2 billion.

The figures describe different measures and should not automatically be added together as separate recoveries. The supplied account does not specify how much they overlap.

Court approval also does not mean the money has already been returned to victims. According to AP, authorities generally bring a forfeiture claim before a judge determines who has a rightful claim to recovered assets.

For the crypto scam investigation, the disclosed action centres on seized infrastructure and recovered recordings. For the Binance case, the focus is on restricting stolen funds and pursuing them through the courts.

Neither announcement establishes that all losses have been recovered. Together, they show authorities working to interrupt the attackers’ operations while addressing the separate legal process required to resolve claims over seized assets.