FBI dismantles North Korean hacker network; The aim of the coup was to finance illicit weapons in the country

North Korean leader Kim Jong Un participates in an unmanned aircraft technology exhibition and a weapons demonstration, in this photo released by the North Korean Central News Agency (KCNA) on October 30, 2026. — Photo: KCNA via Reuters

The United States Department of Justice reported last Thursday (12) that it seized a cloud infrastructure used by North Korean hackers in a scam involving video calls, which resulted in the theft of more than 400 million dollars (R$2.2 billion) in cryptocurrencies over 18 months.

The agency also declared that it had obtained judicial authorization to seize or block more than 1.2 billion dollars obtained in a recent attack on Binance, the largest cryptocurrency broker in the world. The incident caused a drop in the market value of major virtual currencies.

What is known so far?

According to the Department of Justice, hackers sent meeting invitations from compromised accounts belonging to previous victims. When the target joined the call, the hackers would record video from their webcam and then play a pre-recorded clip of a person known to the victim, creating the illusion that trusted contacts were present.

The FBI, which called the scheme FaceStealer ("face stealer"), stated that hackers also began using deepfakes – fake images generated by artificial intelligence – of well-known figures in the cryptocurrency sector.

Hackers would then simulate a technical failure and offer a link to "fix" it, which resulted in the installation of malware – programs created to harm, spy on or access systems without authorization.

In some cases, they waited months, or even more than a year, before stealing the funds. Subsequently, they used the victim's contacts to identify new targets.

Who were the targets of the coup?

— Photo: Illustrative image/Pexels/Tima Miroshnichenko

Most targets work in the cryptocurrency sector or other internet-related areas. According to the department, hackers have increasingly targeted open source software developers, apparently with the aim of enabling supply chain attacks.

The FBI seized more than 900 webcam videos of victims based on a warrant issued by a federal judge.

"If you can't imagine a scenario in which you could fall for this scam, you're not thinking creatively enough," said Patrick Grandy, head of the FBI's Los Angeles office.

The FBI associates FaceStealer with a hacker group known as Sapphire Sleet or UNC1069. This group is different from the North Korean military hackers identified as responsible for the Binance theft.

What happened to Binance?

Binance logo. — Photo: Dado Ruvic/Reuters

In the case of Binance, the FBI reported that the group known as TraderTraitor stole more than 6 billion dollars around October 29th. The Associated Press (AP) news agency estimated the value at around 6.3 billion dollars (the equivalent of R$35.6 billion) and classified the incident as the largest cryptocurrency theft ever recorded.

According to the AP, authorities usually file a confiscation request in court; then a judge decides who has a legal right to the recovered funds.

Since then, U.S. government agencies and private companies have managed to freeze more than $2.7 billion, the department said.

“The government of North Korea funds its authoritarian regime and illicit weapons program through the theft of cryptocurrencies,” said M. Scott Proctor, the Justice Department’s principal deputy assistant attorney general for national security affairs.

North Korea has denied any involvement in the attack on Binance.