The FBI dismantled a North Korean FaceStealer scheme that used stolen webcam footage to steal over $400 million in crypto, bankrolling the regime’s weapons program.
Federal agents and Justice Department prosecutors moved this week against a North Korean hacking operation that secretly recorded tech workers on their own webcams, then used those clips to impersonate trusted colleagues and steal cryptocurrency on a massive scale.
Daily Caller reported that the FBI dubbed the plot “FaceStealer.” Over 18 months the scheme pulled in more than $400 million in stolen cryptocurrency. More than 900 tech workers had their webcam footage captured. The Justice Department said Thursday it took control of the hackers’ online infrastructure and seized the stolen videos.
The same Thursday, the FBI posted a Flash alert and report describing the tactics. On Friday, the bureau released a YouTube video walking through how the scams worked. Officials tied the thefts directly to funding for North Korea’s rogue government and weapons programs.
The method was straightforward and effective. North Korean operators first seized employees’ accounts. They then covertly recorded webcam footage of their targets. With those recordings in hand, the hackers posed as people the victims already knew or respected in the industry.
Jeremy Robertson, the FBI special agent in charge of counterintelligence and cyber work at the Los Angeles field office, explained the sequence in the Friday video.
"North Korean hackers send you a message impersonating someone you know, or someone significant in your industry... Next, they lure you into a realistic but imposter Zoom or Teams meeting,"
Robertson said. Once the victim joined the fake meeting, the hackers recorded them waiting for it to start. Other “participants” on the call were often recordings of earlier victims. The operators then claimed the audio was broken and pushed a fake “update.” That file was malware. It gave them access to the victim’s computer and, from there, to cryptocurrency holdings.
The FBI said the operation has begun adding AI deepfake technology, computer-generated fake video of a person’s face and voice, to make the impersonations even harder to spot. Several other North Korean attempts to target tech workers have already been identified. In one case, the same FaceStealer approach fooled a developer who helps run a popular free software package into downloading the malware. The bureau warned that single breach “could easily have resulted in very large-scale victimization.”
Prosecutors did not stop at public warnings. The Justice Department announced Thursday that it had taken over the hackers’ online setup and seized the library of stolen webcam videos. Courts have already approved the seizure or restraint of more than $1.2 billion in stolen assets. That figure sits inside a larger total: authorities and private companies together have frozen more than $2.7 billion linked to these and related thefts.
Principal Deputy Assistant Attorney General for National Security M. Scott Proctor put the motive in plain terms.
"North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,"
Proctor said. He added that the National Security Division “will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.”
U.S. Attorney for the District of Columbia Jeanine Ferris Pirro described the speed of the response.
"By springing into action at a moment’s notice, we worked together to freeze this massive criminal fraud in its tracks,"
Pirro said. She continued:
"The North Korean regime may think they are sophisticated cyber criminals, but we have consistently met them head on, as we did here seizing more than $1.2 billion of their stolen assets."
FaceStealer is not an isolated campaign. The Justice Department press release noted that North Korean military hackers known as TraderTraitor previously looted more than $6 billion in cryptocurrency from the exchange Binance on Oct. 29. A Binance spokesperson told the Daily Caller News Foundation that roughly $6.34 billion worth of digital assets were affected in that incident and about $2.85 billion has been “frozen or intercepted so far.”
The exchange said its teams are still working with law enforcement, blockchain intelligence firms, and industry partners to recover more of the funds. “Recovery is ongoing and we’ll share further verified updates through official Binance channels,” the spokesperson said.
The overlap between the FaceStealer $400 million total and the larger Binance and multi-billion freezes is not broken out in the public materials. What is clear is the pattern: North Korean operators keep targeting the crypto sector because the money moves fast and the regime needs hard currency outside normal banking channels.
The FBI’s findings show the hackers prefer people already inside technology companies. Once they control one webcam and one account, they can manufacture trust for the next target. The more than 900 recorded workers represent a ready-made library of faces and voices that can be replayed or, increasingly, turned into deepfakes.
That library is now in U.S. hands. Seizing the videos cuts off one supply of fresh impersonation material. Taking the online infrastructure offline disrupts the command-and-control side of the operation. Freezing the cryptocurrency stops the cash from reaching Pyongyang’s weapons programs, at least the portion that has been located.
Neither the FBI nor the Justice Department immediately answered additional questions from the Daily Caller News Foundation after the announcements. No individual arrests or criminal charges were detailed in the materials released this week. The public focus stayed on the infrastructure seizure, the asset freezes, and the warning to tech employees who still take unsolicited video-call invitations at face value.
North Korea has turned webcam theft and fake meetings into a weapons-funding machine. American agents just took the cameras, the servers, and more than a billion dollars of the haul offline.
