The FBI announced Thursday that it has disrupted a sophisticated cybercrime operation run by North Korean hackers, which siphoned more than $400 million in cryptocurrency from victims over the past 18 months. The scheme, dubbed “FaceStealer,” relied on fake video-conferencing platforms, covert webcam recordings, and targeted computer intrusions to compromise individuals working in the digital asset industry.
According to a statement posted on the FBI’s Cyber Division’s official X account, the operation not only led to significant financial losses but also involved the seizure of over 900 webcam videos of victims from around the world. The agency said it had taken down cloud-based infrastructure used in the scheme, marking a notable counterintelligence success against a persistent state-sponsored threat.
The hacking cluster behind FaceStealer has been identified as “Sapphire Sleet,” also tracked as UNC1069. This group operates separately from the North Korean actors linked to the recent massive breach of cryptocurrency exchange Binance, which resulted in losses estimated at $6.3 billion. That attack, attributed by the FBI to Pyongyang, prompted Binance to temporarily halt all deposits and withdrawals, and other crypto firms froze roughly $3 billion in assets in response.
North Korea has categorically denied involvement in the Binance hack. Kim Yo Jong, the influential sister of leader Kim Jong Un, dismissed the U.S. accusations as “a trite provocation.” In a statement, she asserted that Washington has repeatedly tried to link the Democratic People’s Republic of Korea to international cybercrime without evidence, calling it a deliberate attempt to mislead the global community.
Blockchain analytics firms TRM Labs and Chainalysis had previously pointed to a different North Korean group, known as TraderTraitor, as the likely culprit in the Binance incident. Binance itself described the attack as a “sophisticated, multi-stage campaign” that included a malicious software download and a fake job interview, underscoring the evolving tactics used by state-backed hackers.
The FBI’s disruption of FaceStealer comes amid heightened concerns over North Korea’s cyber activities, which U.S. officials say generate revenue for the regime’s weapons programs. The seizure of webcam footage highlights the invasive nature of the scheme, which often involved recording victims without their knowledge during fake video calls.
While the FBI did not disclose the full scope of the disruption, the takedown of the infrastructure is a significant blow to the operation. However, experts warn that North Korean hackers are likely to adapt and develop new methods, as they have done repeatedly in the past.
The announcement also follows a series of high-profile cyber incidents attributed to Pyongyang, including the recent political fallout in Washington over cybersecurity preparedness. The FBI’s action demonstrates ongoing efforts to counter these threats, but the scale of the losses underscores the challenges facing regulators and the crypto industry.
