North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure
DOJ seizes $1.2B in crypto, disrupts North Korean hacker infrastructure and FaceStealer scheme.
The U.S. Department of Justice announced actions against North Korea's cryptocurrency theft operations, seizing over $1.2 billion in stolen funds from Binance and disrupting infrastructure used in the FaceStealer social engineering scheme. The FaceStealer scheme, which has stolen over $400 million, uses AI-generated deepfakes and social engineering to trick victims into installing malware. The same North Korea-linked actors, also known as Sapphire Sleet and APT38, are now targeting open-source developers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Binance?
Get an email when a new story names Binance, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonNorth Korea-linked threat actors (Sapphire Sleet/APT38) successfully stole over $1.2 billion in cryptocurrency by exploiting the weakest link in security: human trust. The FaceStealer scheme leveraged AI-generated deepfakes and sophisticated social engineering to trick victims into installing malware, bypassing technical controls entirely. Critically, these same actors are now targeting open-source developers, poisoning the software supply chain and threatening organizations that consume community-built tools. This incident demonstrates that even technically sophisticated environments can be compromised when users are unprepared to recognize AI-enhanced deception. As deepfake technology becomes more accessible, the credibility of social engineering attacks will only increase, making human-layer defenses a top priority.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — FaceStealer