US disrupts North Korean campaign behind $400 million crypto theft

The United States government dismantled a massive 18-month North Korean cyber operation known as FaceStealer that stole over $400 million in cryptocurrency from technical professionals. According to details shared in BleepingComputer's report, federal authorities seized the cloud-based infrastructure powering the campaign. The threat actors combined hijacked corporate communications, pre-recorded video impersonations, and deceptive troubleshooting prompts to compromise targets across the cryptocurrency, Web3, and software development sectors.

This analysis details the operational mechanics, attribution findings, and corporate targets of the FaceStealer intrusions for engineering leaders, security teams, and open-source software maintainers. It examines how operatives weaponized popular collaboration software, accumulated clandestine video libraries, and compromised software ecosystems. Readers will also find actionable defense measures recommended by federal investigators alongside recent enforcement actions connected to North Korean digital asset theft.

01Cloud infrastructure seizure and stolen millions

Federal authorities terminated the FaceStealer campaign after seizing the central cloud infrastructure that supported hostile operations for a year and a half. The cyber actors accumulated more than $400 million in digital assets by compromising decentralized finance personnel and Web3 staff. Investigators uncovered extensive databases during the infrastructure takeover, confirming that the adversary maintained systematic persistence across corporate environments.

Investigators discovered more than 900 secret webcam recordings captured from deceived tech workers while reviewing the captured systems. These surreptitious files recorded targets across various companies as they prepared for scheduled calls. The repository gave operatives an expanding library of visual assets to manufacture convincing social engineering environments for future intrusions.

Federal Bureau of Investigation bulletins confirmed that threat actors frequently delayed exploitation after gaining initial access to compromised systems. Operatives routinely monitored victims passively for several months or exceeding a full calendar year. This patient posture allowed attackers to strike when an individual accumulated substantially larger cryptocurrency balances.

02Recorded webcam footage and fake error fixes

The intrusion workflow began when operatives hijacked legitimate user accounts on Slack, Discord, Telegram, and LinkedIn. Attackers utilized these trusted profiles to dispatch meeting invitations to targeted individuals under realistic professional pretexts. Targets accepted calendar invites expecting routine technical or business discussions with known contacts or industry peers.

During the scheduled video conferences, the attackers presented pre-recorded footage of people whom the targets personally recognized from prior compromises. While the unsuspecting victim sat waiting for discussions to begin, the adversary activated the victim's camera to secretly record new video clips. The conference interface sometimes displayed feeds of multiple familiar individuals simultaneously to amplify social pressure.

The hostile operator then triggered a simulated technical failure, showing a fake error message and presenting a malicious fix through a download link. The delivered installer deployed malware engineered to steal crypto wallet data alongside credentials for Zoom, Microsoft Teams, and Google Meet. The payload simultaneously harvested communication records, contact directories, social media accounts, and stored webcam archives.

03BlueNoroff executive lures across fifty-eight countries

Threat intelligence researchers at ArcticWolf attributed the FaceStealer intrusion campaign directly to the North Korean state-sponsored threat group BlueNoroff. Analysis of threat telemetry revealed 677 distinct targets spanning 58 countries worldwide. The adversary demonstrated a clear bias toward company founders and senior corporate executives possessing privileged access to operational treasury holdings.

Investigators identified diverse social engineering lures designed to convince executives to execute malicious code under the guise of procedural compliance. Operatives distributed fraudulent financial records, forged PDF reader software updates, identity verification prompts, and bogus security audits. Each deceptive document directed the victim toward a scripted remedy that covertly executed intrusive surveillance software.

Security firm Huntress previously connected BlueNoroff to a related 2025 cyber campaign that targeted corporate executives during Zoom conferences. In those earlier intrusions, attackers deceived leadership personnel into executing custom macOS malware. The ongoing evolution of these tactics demonstrates sustained state interest in infiltrating high-net-worth leadership teams across multiple operating systems.

04Supply chain targeting of open-source ecosystems

Federal bulletins highlighted an aggressive expansion of FaceStealer operations into the open-source software supply chain. Attackers compromised the maintainer of a widely used JavaScript library that registers tens of millions of weekly downloads. The developer joined a fraudulent Microsoft Teams conference that staged multiple participant video streams, including the likeness of a trusted colleague.

Rapid anomaly detection successfully neutralized the JavaScript library compromise before rogue code reached downstream package consumers. Federal investigators subsequently confirmed multiple parallel social engineering attempts aimed at software authors across the npm repository and Rust crate ecosystems. State actors targeted these registry maintainers to inject backdoors into commercial software build pipelines.

Threat analysts at Amazon corroborated this widespread operational focus in a July 2026 intelligence report that attributed several open-source supply chain intrusions to BlueNoroff. The findings revealed coordinated attempts to manipulate software repositories and hijack upstream build dependencies. Compromising core code libraries provided the threat group a scalable pathway into critical enterprise infrastructure worldwide.

05Protective security measures and frozen exchange assets

Security agencies advise software engineers and executives to access video conferences exclusively through official applications using direct invitation codes. Organizations must verify unexpected meeting requests through secondary communication channels and maintain webcams in disabled states unless operational requirements demand video. Personnel should never execute external scripts or binaries delivered as troubleshooting fixes during conferences.

The United States Department of Justice announced concurrent enforcement actions targeting North Korean financial operations alongside private sector security partners. Authorities successfully froze over $2.7 billion connected to the historic $6.4 billion cryptocurrency theft from the Binance exchange. The Justice Department secured formal judicial orders authorizing the seizure or restraint of more than $1.2 billion of those assets.

Coordinated infrastructure takedowns and asset forfeitures illustrate a tightening federal posture against overseas state-backed cryptocurrency theft rings. By combining cloud host seizures with international financial freezes, enforcement agencies aim to disrupt the technical apparatus and liquidity pipelines funding foreign cyber operations. Organizations operating in digital finance and open-source infrastructure must continue enforcing strict operational safeguards.