The United States agency has accused North Korea of using massive cryptocurrency theft to fund its rogue regime and illicit weapons programme. In coordinated actions announced on Thursday, November 12, 2026, the Department of Justice said the Democratic People’s Republic of Korea government has turned cybercrime into a major source of funding for the state.
As part of the crackdown, US authorities have obtained court authorisation to seize and restrain more than $1.2 billion worth of cryptocurrency recently stolen from Binance, one of the world’s largest virtual currency exchanges. Officials said the seizure is part of a wider effort to freeze the stolen assets before they disappear beyond law enforcement reach.
The Justice Department said the actions target two separate but related North Korean schemes. The first is a social engineering campaign known as FaceStealer, which has stolen more than $400 million worth of cryptocurrency in the last 18 months. The second is the theft of more than $6 billion worth of virtual assets from Binance on or about October 29.
FaceStealer, according to the FBI, is a highly effective scheme that uses surreptitiously recorded videos and artificial intelligence deepfakes to deceive victims. Hackers lure targets with invitations to video meetings sent from accounts stolen from previous victims, then play prerecorded videos of trusted contacts to gain trust. During the meeting, they introduce a fake technical error and provide a link to fix it, which secretly installs malware on the victim’s computer.
Once a computer is compromised, the hackers can steal cryptocurrency or exploit access to other systems. In several cases, they stole funds and hijacked communication accounts months to more than a year after the initial compromise. The hackers also accessed victims’ contact lists, social media and communications apps to target their personal and professional contacts. The FBI said it seized over 900 webcam videos of FaceStealer victims under a federal warrant.
“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said Principal Deputy Assistant Attorney General for National Security M. Scott Proctor. “Today’s announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime. The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.”
The Binance theft was attributed to members of the North Korean military known by the FBI as TraderTraitor. Since the theft, the National Security Division, the Criminal Division’s Computer Crime and Intellectual Property Section, the US Attorney’s Office for the District of Columbia, and law enforcement partners have worked closely with virtual asset service providers to interdict the stolen assets.
Collective US government and private sector efforts have so far resulted in the freeze of more than $2.7 billion, with the Department already obtaining court authorisation to seize or restrain in excess of $1.2 billion of that amount. Officials said efforts to trace, freeze, seize and forfeit the stolen assets are ongoing, as TraderTraitor actors continue to launder funds through bridges, mixers and exchanges.
The FBI has also warned that North Korean hackers are increasingly targeting individuals in the cryptocurrency and Web3 industries, as well as those involved in the development and maintenance of open-source software. Officials said this targeting appears calculated to enable software supply-chain attacks. The FBI has published a detailed report on the FaceStealer scheme and created a website, http://www.fbi.gov/facestealer, to serve as a central hub for resources and protection tips.
“The Criminal Division, specifically the Computer Crime and Intellectual Property Section, and our law enforcement partners played the critical role in immediately freezing billions of dollars’ worth of stolen Binance digital assets before they got beyond law enforcement reach,” said Assistant Attorney General A. Tysen Duva of the Criminal Division. “As the Department’s liaison to the digital asset industry, the Criminal Division quickly and efficiently used its expertise to immediately halt about half of this historic breach.”
US authorities say the fight is far from over, but the latest seizures show Washington is determined to impose cost on North Korea and disrupt its ability to profit from cybercrime.
