Follow-Up: Justice Department Disrupts North Korea Crypto Theft, Freezing Over $2.7B in Stolen Binance Assets and Breaking Up a Deepfake Video-Meeting Scheme

The U.S. Department of Justice on November 12, 2026, announced coordinated actions against the North Korean government's schemes to fund its regime through the massive theft of cryptocurrency. The actions include the seizure of cloud-based infrastructure used in the FaceStealer social engineering scheme, which has resulted in the theft of more than $400 million worth of cryptocurrency, and the freezing of more than $2.7 billion in assets stolen from Binance, with court authorization to seize or restrain more than $1.2 billion of that amount.

GSM previously reported that Binance lost more than $6.3 billion in virtual assets in late October. The Justice Department now says that on or about October 29, members of the North Korean military referred to by the FBI as TraderTraitor stole more than $6 billion in virtual assets from Binance. Since then, the National Security Division, the Criminal Division, the U.S. Attorney's Office for the District of Columbia and law enforcement partners have worked with virtual asset service providers to interdict the stolen assets, freezing more than $2.7 billion so far, with efforts to trace, freeze, seize and forfeit the assets ongoing.

Separately, the U.S. Attorney's Office for the Central District of California announced the disruption of the FaceStealer scheme. North Korean hackers lured targets with video meeting invitations sent from accounts stolen from prior victims, played recorded video of previous victims to simulate trusted contacts, and used super intelligence (SI) deepfake videos of well-known figures in the cryptocurrency and Web3 industries to gain trust.

During the meetings, the hackers introduced a fake technical error, such as claiming the target could not be heard, and offered a fix link or prompt that secretly installed malware. With the target's computer compromised, the hackers stole cryptocurrency and hijacked communication accounts and contact lists to target the victim's contacts. The scheme has stolen more than $400 million in the last 18 months and has increasingly targeted open-source software developers and maintainers in an apparent bid to enable supply-chain attacks. Under a federal warrant, the FBI seized over 900 webcam videos of FaceStealer victims and published a report and resource page on the scheme.

Principal Deputy Assistant Attorney General for National Security M. Scott Proctor said North Korea bankrolls its regime and illicit weapons program through cryptocurrency theft, and that the United States will use every tool to seize and return those ill-gotten gains. Assistant Attorney General A. Tysen Duva of the Criminal Division said the division quickly froze about half of the stolen digital assets in the historic breach. FBI Cyber Branch Operations Director Brett Leatherman said North Korean actors have used FaceStealer to aggressively target the cryptocurrency and Web3 sectors, stealing more than $400 million in the last 18 months. (Source: U.S. Department of Justice)

Source: U.S. Department of Justice

Published by GSM · USA (original Chinese edition)

Photo: 图：位于华盛顿特区的联邦调查局 FBI 总部大楼（联邦固定图库）。 / Photo: FBI headquarters building in Washington, D.C. (federal asset library).

Latest in Justice

Former Telecom Construction CEO Pleads Guilty: Looted Over $5M, Paid Over $1M in Bribes, Agrees to Pay Over $25M in Restitution2026-11-12Follow-Up: Flushing Adult Day Care Director Pleads Guilty in $127M Medicare and Medicaid Fraud Scheme2026-11-12