U.S. disrupts North Korean FaceStealer campaign, linked to about $400 million in cryptocurrency thefts

CHRONOS Cybersecurity & Infrastructure category illustration. Illustrative only, not specific to this event. — Illustrative image, not a photograph of this event.

Urgency: L4
: 72
: 80
: 40
: 60
: 90

At a glance

In November 2026 the U.S. Department of Justice and FBI announced disruption of cloud-based infrastructure used by a North Korean-linked social engineering campaign called FaceStealer. Public reporting and agency statements attribute about $400 million in cryptocurrency thefts to the campaign. The agencies described the actions as disruptions of the campaign's infrastructure.

DOJ and FBI announced disruption of cloud infrastructure used by FaceStealer, which reporting links to about $400M in crypto theft.

CHRONOS Wire · November 14 · Alert 11

What happened

In November 2026 the U.S. Department of Justice and the FBI announced they disrupted cloud infrastructure used by a North Korean-linked social engineering campaign called FaceStealer. Public reporting and agency statements attribute about $400 million in cryptocurrency thefts to that campaign. The actions are described by the agencies as disruptions of the campaign's infrastructure.

Why it matters

Public enforcement actions against a high-value crypto-theft campaign were announced in November 2026 and may be followed by additional agency updates or reporting in the near term.

CHRONOS Bottom Line

The DOJ and FBI announced coordinated actions in November 2026 that disrupted cloud infrastructure used by the North Korean-linked FaceStealer campaign, which reporting links to about $400 million in cryptocurrency thefts.

Full detail

What changed

In November 2026 the U.S. Department of Justice and FBI publicly announced disruption of cloud-based infrastructure used by the FaceStealer campaign, and public reporting attributes about $400 million in cryptocurrency thefts to the campaign.

What is genuinely new

Public DOJ and FBI announcements in November 2026 stating they disrupted cloud infrastructure used by the FaceStealer campaign, and public reporting linking the campaign to about $400 million in cryptocurrency thefts.

Detailed analysis

Public materials from the DOJ and FBI in November 2026 describe coordinated actions to disrupt cloud infrastructure used by the FaceStealer social engineering campaign. Independent coverage cites that the campaign is responsible for roughly $400 million in cryptocurrency thefts. The available sources describe the announced actions as disruptions of the campaign infrastructure; the supplied excerpts do not quote language explicitly saying the measures were undertaken to support forfeiture or prosecutions.

U.S. Impact

Current impact

Elevated

DOJ and FBI public actions to disrupt cloud-based infrastructure used by FaceStealer are announced and in effect, lowering immediate operational risk from this specific campaign.

Potential impact

Low

Disruption of campaign infrastructure may reduce near-term operational ability of this named campaign and could aid investigations or recovery efforts.

Impact type: Direct
Confidence: Very High

U.S. Impact is an analytical assessment of the estimated current and potential effects on the United States. It is not a probability forecast.