More than 900 secretly recorded webcam videos have been recovered by US investigators examining a North Korean cybercrime operation that used familiar faces to deceive cryptocurrency investors and technology professionals. The recordings were part of a scheme that authorities say generated over $400 million in stolen digital assets during the past 18 months.
The FBI identified the campaign as FaceStealer and announced on November 12, 2026, that cloud infrastructure supporting the operation had been seized. Investigators attributed the activity to North Korean hackers tracked under several names, including BlueNoroff, Sapphire Sleet, and UNC1069.
Unlike conventional phishing campaigns, FaceStealer exploited existing professional relationships. Attackers first compromised communication accounts belonging to individuals in the cryptocurrency industry, then used those accounts to invite their contacts to apparently legitimate video meetings.
During these meetings, victims saw prerecorded footage of people they recognized. In some cases, the attackers also used AI-generated deepfake videos impersonating influential figures in the cryptocurrency and Web3 sectors.
The deception continued when a fabricated audio problem appeared during the call. Participants were instructed to follow a link or execute commands presented as a technical fix. Instead, those actions installed malware capable of stealing sensitive information, compromising cryptocurrency wallets, and providing access to additional accounts.
The attackers also recorded new participants without their knowledge. Their videos, contact lists, and compromised communication accounts could subsequently be used to approach further targets.
Security researchers have identified 677 targets across 58 countries, with founders and senior executives accounting for more than 80% of those identified. The campaign has also expanded toward developers maintaining widely used open-source software.
Investigators linked the operation to an attempted software supply-chain compromise involving the popular Axios JavaScript package. Access to a developer’s environment enabled malicious code to be introduced into a software release, although the attack was detected before it spread widely.
Separately, the US Justice Department announced court-authorized action involving more than $1.2 billion in cryptocurrency stolen from Binance. That theft, attributed to a different North Korean operation known as TraderTraitor, involved more than $6 billion in digital assets.
Authorities said public and private sector cooperation had frozen over $2.7 billion connected to the Binance incident, including the assets covered by the court orders.
The FBI has established a dedicated FaceStealer information resource as investigators continue examining the campaign. Meanwhile, efforts to trace and recover the remaining Binance funds are ongoing, with authorities reporting that the stolen assets are being moved through cryptocurrency bridges, mixers, and exchanges.