DOJ disrupts North Korea's FaceStealer deepfake-call scheme after $400M crypto theft over 18 months

US authorities seized the cloud infrastructure behind FaceStealer, an 18-month North Korean social-engineering campaign attributed to BlueNoroff that netted $400M+ in crypto by luring victims into fake Zoom/Teams calls that replayed prerecorded webcam footage of trusted contacts to simulate their presence. The FBI recovered 900+ secretly recorded webcam clips; Arctic Wolf identified 677 targets in 58 countries, over 80% founders or C-suite. Justice also froze $2.7B tied to a $6.4B Binance heist and moved to seize $1.2B more.