INCIDENT REPORT · CP-2026-019

North Korean FaceStealer Crypto Theft Campaign

L3 · ELEVATEDCONFIRMED

On Nov 13, 2026 the U.S. Justice Department and FBI disclosed that a North Korean social-engineering scheme they call FaceStealer had stolen more than $400 million in cryptocurrency over roughly 18 months by luring crypto holders and industry workers into fake video calls that deliver wallet-stealing malware. Announcing the theft figures, authorities said they had disrupted the scheme's cloud infrastructure and seized more than 900 victim webcam recordings.

Incident ID: CP-2026-019
Disclosure date: 13 NOV 2026
Detection date: Not publicly documented
Affected countries: United States
Plotted location: Los Angeles, United States (Approximate: victims dispersed globally; U.S. federal district (C.D. Cal.) announcing the case)
Threat classification: Level 3 — ELEVATED
Classification rationale: State-sponsored theft exceeding $400M from hundreds of victims across the crypto sector.
Attack type: Cryptocurrency Theft
Nature: Malicious activity
Attack vector: Social engineering via video calls using stolen accounts, prerecorded footage of earlier victims and AI deepfakes, with a fake audio-problem 'fix' that installs wallet-stealing malware
Sectors: Finance, Technology
Critical infrastructure: No
Organizations affected: Cryptocurrency and Web3 sector individuals and firms
Operational consequences: The FBI says more than $400 million was drained from the cryptocurrency and Web3 sectors and reports more than 900 victims, whose recorded footage was reused to target new victims.
Estimated financial impact: $400M — FBI/DOJ figure: 'more than $400 million' stolen over about 18 months; separate from the $1.2 billion Binance-theft seizure announced the same day.
Attribution (as stated): Attributed by the FBI and U.S. Department of Justice to North Korean state-sponsored hackers (reporting cites APT38/BlueNoroff)

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

North Korean FaceStealer Crypto Theft Campaign

L3 · ELEVATEDCONFIRMED

Incident ID

CP-2026-019

Disclosure date

13 NOV 2026

Detection date

Not publicly documented

Affected countries

United States

Plotted location

Los Angeles, United States (Approximate: victims dispersed globally; U.S. federal district (C.D. Cal.) announcing the case)

Threat classification

Level 3 — ELEVATED

Classification rationale

State-sponsored theft exceeding $400M from hundreds of victims across the crypto sector.

Attack type

Cryptocurrency Theft

Nature

Malicious activity

Attack vector

Social engineering via video calls using stolen accounts, prerecorded footage of earlier victims and AI deepfakes, with a fake audio-problem 'fix' that installs wallet-stealing malware

Sectors

Finance, Technology

Critical infrastructure

Organizations affected

Cryptocurrency and Web3 sector individuals and firms

Operational consequences

The FBI says more than $400 million was drained from the cryptocurrency and Web3 sectors and reports more than 900 victims, whose recorded footage was reused to target new victims.

Estimated financial impact

$400M — FBI/DOJ figure: 'more than $400 million' stolen over about 18 months; separate from the $1.2 billion Binance-theft seizure announced the same day.

Attribution (as stated)

Attributed by the FBI and U.S. Department of Justice to North Korean state-sponsored hackers (reporting cites APT38/BlueNoroff)