{"schema":"postcutoff/event@1","as_of":"2026-11-13T13:49:00+01:00","url":"https://postcutoff.com/e/2026-11-12-doj-fbi-facestealer-north-korea-deepfake-calls/","md":"https://postcutoff.com/e/2026-11-12-doj-fbi-facestealer-north-korea-deepfake-calls/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"human editor","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-11-12-doj-fbi-facestealer-north-korea-deepfake-calls","date":"2026-11-12","date_precision":"day","short_title":"FBI disrupts 'FaceStealer', a North Korean deepfake video-call scheme blamed for $400M+ in crypto theft","deck":null,"takeaway":"Hackers took over social media accounts, invited targets' contacts to fake Zoom, Teams or Meet calls and played recorded clips and AI deepfakes of people they knew.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":[{"n":1,"title":"US DOJ: Justice Department announces actions to disrupt North Korea's massive theft of cryptocurrency (Nov 12)","url":"https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency","type":"official","group":"primary","domain":"justice.gov"},{"n":2,"title":"Reuters: North Korean hackers steal more than $400 million using video images, FBI says","url":"https://www.reuters.com/world/asia-pacific/north-korean-hackers-steal-more-than-400-million-using-video-images-fbi-says-2026-11-12/","type":"press","group":"press","domain":"reuters.com"},{"n":3,"title":"The Hill: FBI: North Korean hackers have stolen $400 million in crypto over last 18 months","url":"https://thehill.com/policy/technology/6217605-north-korean-hackers-stole-crypto/","type":"press","group":"press","domain":"thehill.com"},{"n":4,"title":"Newsweek: The 6 stages of FaceStealer","url":"https://www.newsweek.com/facestealer-north-korean-scam-12709539","type":"press","group":"press","domain":"newsweek.com"}],"official":1,"filed":"2026-11-13","updated":"2026-11-13","orgs":["FBI","US Department of Justice"],"title":"FBI disrupts 'FaceStealer', a North Korean deepfake video-call scheme blamed for $400M+ in crypto theft","summary":"On Nov 12, 2026 the US Justice Department announced it had disrupted cloud infrastructure behind \"FaceStealer\", a North Korean social engineering campaign that the FBI says stole more than $400M in cryptocurrency in about 18 months. Hackers took over social media accounts, invited targets' contacts to fake Zoom, Teams or Meet calls and played recorded clips and AI deepfakes of people they knew. The FBI seized more than 900 victims' webcam recordings.","key_facts":["DOJ headline: 'North Korean Super Intelligence-Enabled Social Engineering Campaign Known as \"FaceStealer\"'; release: the hackers 'use super intelligence (SI) to develop deepfake videos' and the scheme 'relies on surreptitiously recorded videos and artificial deepfakes'","Scale (FBI): over $400M stolen in about 18 months; more than 900 victims (press reports)","Action: court-authorised disruption of cloud infrastructure (Central District of California); seizure of 900+ webcam videos of victims; FBI report and resource site fbi.gov/facestealer; victims asked to report to IC3 with the keyword 'FaceStealer'","Attribution in press: Sapphire Sleet, BlueNoroff and Stardust Chollima (Newsweek); separate from the 'TraderTraitor' group blamed for the Oct 29 Binance theft","Same release: DOJ obtained authority to seize or restrain more than $1.2B of assets stolen from Binance; $2.7B in total has been frozen (Bloomberg)"],"key_numbers":[],"tags":["deepfakes","misuse","north-korea","crypto","social-engineering","cybercrime"],"science":null,"body_md":"## What happened\n\nThe scheme turned victims into lures: once a person's account and webcam footage were captured, the hackers used that material, and\ndeepfakes made from it, to approach the next targets in fake meetings. The DOJ, which now uses \"super intelligence\" as its term for\nadvanced AI, presented it as an AI-enabled operation.\n\n## Why it matters\n\nIt is one of the largest officially quantified thefts in which US authorities say AI-generated video was part of the method, and it\nshows deepfakes being used against people who know the impersonated person, not only against strangers.","disputed":[],"related":[{"id":"2026-11-05-doj-super-intelligence-task-force","url":"https://postcutoff.com/e/2026-11-05-doj-super-intelligence-task-force/","date":"2026-11-05","date_precision":"day","short_title":"DOJ launches Super Intelligence Task Force","deck":null,"takeaway":"Federal prosecutors now have a dedicated unit for AI-enabled crime.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":2,"official":1,"filed":"2026-11-07","updated":"2026-11-07","orgs":["US Department of Justice"]},{"id":"2026-10-15-north-korea-zam-2-ai-guided-torpedo","url":"https://postcutoff.com/e/2026-10-15-north-korea-zam-2-ai-guided-torpedo/","date":"2026-10-15","date_precision":"day","short_title":"North Korea tests AI-guided Zam-2.0 torpedo","deck":null,"takeaway":"North Korea now presents AI as a selling point across its weapons tests (cruise missiles in May, a hypersonic missile in early October, now a torpedo).","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":4,"official":0,"filed":"2026-10-17","updated":"2026-10-17","orgs":["North Korea"]}],"people":[],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-11-13","type":"filed","text":"Created (news agent)"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-11-13","run":null,"sources_read":null,"updated":"2026-11-13","human_review":null,"version":null},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":196,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":135,"in_training_data":false},{"model_id":"gemini-4-hydrogen","name":"Gemini 4 Hydrogen","cutoff":"2026-03","days_after":226,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":165,"in_training_data":false}],"short_url":null}