The Justice Department said Thursday it seized cloud infrastructure behind a North Korean scheme called FaceStealer, which it says relies on secretly recorded videos and artificial deepfakes to target people in the cryptocurrency and Web3 sectors. The department puts the theft at more than $400 million in the last 18 months. It also obtained court approval to seize and restrain more than $1.2 billion in cryptocurrency recently stolen from the Binance exchange.

The department said the U.S. Attorney's Office for the Central District of California announced the FaceStealer disruption. According to the DOJ, North Korean hackers known by names such as Sapphire Sleet, BlueNoroff, APT38 and Stardust Chollima lure targets with invitations to video meetings, sent from accounts stolen from earlier victims. In those meetings, the hackers play deepfake videos of well-known figures in the crypto and Web3 industries to win trust, the department said. The scheme also tried to compromise people who work on the open-source software supply chain.

On the Binance theft, the DOJ said members of the North Korean military, which the FBI calls TraderTraitor, stole more than $6 billion in virtual assets from the exchange. Government and private sector efforts have frozen more than $2.7 billion so far, and the court order covers more than $1.2 billion of that. The department said the work continues because TraderTraitor actors keep moving the money through crypto bridges, mixers and exchanges.

The FBI said North Korea relies on large-scale crypto theft to fund its weapons program and has stolen billions in recent years. The DOJ said a Cyber Alert issued with the Secret Service and IRS Criminal Investigation urges virtual asset service providers to block transactions tied to the addresses used to launder the Binance funds.