TraderTraitor / FaceStealer: DOJ seizes or restrains $1.2B of Binance crypto, disrupts FaceStealer infra
Severity: high · Patch status: no-fix-needed · Since 2026-11-12
On 2026-11-12 the US Justice Department said it had court authorization to seize or restrain more than $1.2 billion of crypto tied to the theft of more than $6 billion from Binance on or about 2026-10-29, which the FBI attributes to North Korea's TraderTraitor group. More than $2.7 billion has been frozen across government and private-sector efforts, and laundering through bridges, mixers and exchanges continues. The same day the FBI and DOJ announced disruption of cloud infrastructure behind 'FaceStealer', a North Korean social-engineering scheme that has taken more than $400 million in crypto over 18 months and that the FBI links to APT38 and other names. Its operators take over chat and social accounts, invite contacts to Calendly-scheduled calls, then open imitation Zoom or Teams sessions that replay footage of earlier victims. They claim the target's audio is broken and push an update prompt, script or pasted command that installs a browser cookie harvester, keyloggers, screen capture and a backdoor. The FBI has seized more than 900 victim webcam videos, and deepfakes of crypto figures are a secondary tactic. The scheme has also targeted npm and Rust crate maintainers, including a near-miss against a JavaScript library that receives tens of millions of downloads a week. No vendor patch applies. Defenders should join meetings only through official clients, refuse in-call 'fix' steps, verify invitations through a second channel, secure chat and developer accounts with MFA, keep large crypto balances off browser wallets, and report suspected contact to IC3 with the keyword FaceStealer. The FBI said it was unclear whether FaceStealer was used in the Binance breach itself.
What to do
- Join video meetings only through the official Zoom or Teams app with an invite code, not web links, especially for new or infrequent contacts
- Keep your webcam off until you can see and hear the person who invited you
- Never run scripts, paste code into a terminal or accept an 'update' prompt during a video call; update the client separately
- Check scheduling-tool invites (Calendly and similar) for meeting links, and confirm meetings through a different channel from the one the invite came through
- Enable MFA and login alerts on Telegram, WhatsApp, Slack and other chat apps, and on developer accounts (npm, Rust crate registries); log off stale sessions and change passwords
- Keep only low-value balances in browser-extension wallets; hold larger balances on a hardware wallet or with an exchange, and never keep seed phrases on internet-connected devices
- If compromised: move crypto to a new wallet with new seed phrases from a clean device, warn contacts and employers, and report to IC3 with the keyword FaceStealer
Sources
All live incidents on Threat Watch
