North Korean hackers have stolen more than $400 million worth of cryptocurrency over the past 18 months through a scheme involving fake video calls and compromised accounts, the FBI said. The campaign, dubbed FaceStealer, is believed by US investigators to be linked to the group Sapphire Sleet, also known as UNC1069.
The attacks began with an invitation from the profile of an acquaintance or colleague whose account had already been compromised. The victim was directed to a website resembling Zoom, Microsoft Teams or Google Meet. During the call, a recording of someone the victim recognized would appear, while a fabricated audio malfunction served as a pretext for installing malware.
According to the FBI, the program could record keystrokes, capture screen content and provide prolonged access to the device. The stolen contacts and accounts were then used to reach new victims. Investigators seized more than 900 webcam recordings and identified over 677 potential targets in 58 countries.
354 arrests in Operation TorNado
Amid the investigation into the North Korean network, US and European agencies announced the results of Operation TorNado against criminal marketplaces on the dark web. According to the US Department of Justice and Europol, 354 suspected participants in the trade of fentanyl, opioids, other drugs and illicit services were arrested.
The operation covered the United States, Europe, Australia and New Zealand and lasted from May 2025 to October 2026. The arrests were carried out in 14 countries, including 132 in the United States, 59 in the United Kingdom, 45 in Hungary, 41 in Germany and 23 in France.
Investigators seized approximately 5.7 tons of illegal drugs, 209 firearms, 38 pill presses and more than $234 million in cash and cryptocurrency. Some investigations are still ongoing in order to identify the individuals behind the accounts used on the dark web.
Court authorizes the blocking of Binance funds
Separately, the US Department of Justice obtained court authorization to seize or block more than $1.2 billion in cryptocurrency that authorities say is linked to the Binance theft. The attack, carried out in October, involved approximately $6.3 billion, and the FBI has attributed it to the North Korean group TraderTraitor.
US authorities and private companies have already frozen a total of more than $2.7 billion in funds linked to the attack. The $1.2 billion covered by the court orders is part of that total, not additional funds recovered.
The next step is a court proceeding to determine which individuals or companies have rights to the recovered cryptocurrency. According to US officials, recovering the remaining funds is complicated because the perpetrators split them into smaller amounts and transfer them through money-laundering networks.
Sources: apnews.com, streetinsider.com, nextgov.com