Skip to content
Friday, November 13, 2026
Global legal news — updated throughout the day
Independent · Global
COURT CAST
Law · Courts · Power · Across the World
Today’s Edition — 8 verified developments across 3 jurisdictions
North Korea · Legal News

US Targets North Korean Crypto Theft in Two Actions

Authorities seized FaceStealer infrastructure and obtained court authority over more than $1.2 billion linked to a separate Binance theft.

US authorities have announced two court-backed actions against cryptocurrency theft attributed to North Korea: the seizure of infrastructure used in a deepfake-assisted social-engineering campaign and judicial authority to seize or restrain more than $1.2 billion linked to a separate exchange breach.

The first action targets “FaceStealer”, a scheme that the Federal Bureau of Investigation says stole more than $400 million in cryptocurrency over 18 months. Operators invited victims to video meetings from compromised accounts, played recordings or artificial images of trusted contacts and introduced a supposed technical fault. The proposed fix installed malware, giving the attackers access to devices, accounts and digital assets.

A federal warrant allowed the FBI to seize cloud-based infrastructure and more than 900 webcam recordings of victims. The Justice Department said the campaign primarily targeted people working in cryptocurrency and Web3, but had increasingly reached developers and maintainers of open-source software. That pattern raised a separate concern that compromised repository accounts could be used for supply-chain attacks.

The second action concerns an alleged theft of more than $6 billion from Binance on or about 29 October. The department attributes the breach to members of the North Korean military. It said cooperation with virtual-asset providers had frozen more than $2.7 billion and that courts had authorised seizure or restraint of more than $1.2 billion.

Freezing, seizure and restraint do not complete the forfeiture process or determine ownership. The government said tracing and recovery efforts remain active as the assets are moved through bridges, mixers and exchanges.

The two matters are operationally distinct but share the government’s allegation that cryptocurrency theft is being used to support the North Korean state. The Justice Department announced both actions on 12 November.

Details of the warrants, restraint orders and continuing asset-recovery work appear in the official announcement.

Print Friendly, PDF & Email
The Court Cast Research Library

News on the surface. Primary law underneath.

Search judgments, official documents, oral arguments and the accumulated record behind the daily edition.

Oral arguments
84,000+

A deep searchable record of court proceedings.

Explore
Global

Judgments · Documents · Practice Notes · Jurisdictions · Events

Scroll to Top