U.S. Department of Justice Dismantles FaceStealer Cloud Infrastructure
Start here
AI-assisted source synthesis · not an independent investigation.
On November 13, 2026, the FBI said North Korean hackers used FaceStealer to carry out scams targeting cryptocurrency video calls: They first used accounts stolen from previous victims to invite new targets to calls, then played prerecorded footage of people the targets knew; they also lured targets into installing malware by claiming there were fake audio problems. The FBI said FaceStealer stole more than $400 million in cryptocurrency over 18 months, and the attackers also targeted open-source developers’ devices and code repository accounts. The U.S. Department of Justice has dismantled FaceStealer’s cloud infrastructure; the FBI seized more than 900 victim webcam videos pursuant to federal search warrants.
AI-written from reports · updated 1 hour ago
Timeline
Follow the reporting to see the different sides of the story.
- CryptopolitanFBI says North Korean hackers used FaceStealer to pose as trusted contacts in cryptocurrency video calls
The FBI says North Korean hackers used accounts stolen from previous victims to invite new targets to video calls and played prerecorded footage of people the targets knew. FaceStealer stole more than $400 million in cryptocurrency over 18 months. The U.S. Department of Justice has dismantled its cloud infrastructure, and the FBI seized more than 900 victim webcam videos under federal search warrants. The hackers tricked targets into installing malware by claiming there were audio problems, and also targeted open-source developers’ devices and code repository accounts.
Heat over time
Not enough consecutive observations yet to draw a trend.