FlagThis — Daily Cybersecurity Intelligence Briefing

U.S. federal authorities, led by the DOJ and FBI, have disrupted the "FaceStealer" campaign, a North Korean state-sponsored operation attributed to APT38 and Sapphire Sleet. The actors employed advanced social engineering TTPs targeting cryptocurrency developers and users, resulting in the theft of over $400 million in digital assets over 18 months. Law enforcement successfully seized cloud-based command-and-control (C2) infrastructure and recovered over 900 victim webcam videos. Additionally, approximately $1.2 billion in assets linked to a high-profile Binance hack were seized, significantly hindering the DPRK’s ability to leverage stolen cryptocurrency for state revenue and laundering operations.

Between October 29–30, 2026, attackers drained approximately $6.3 billion from Binance hot wallets across multiple blockchains. TRM Labs attributed the intrusion with high confidence to TraderTraitor, a North Korean state-sponsored actor. Initial access was gained via a compromised engineer/DevOps laptop, enabling unauthorized withdrawals from Binance hot wallet 0x28C6c06298d514Db089934071355E5743bf21d60. Attackers exploited Ethereum EIP-7702 via a Type-4 transaction containing 50 consecutive authorization payloads (nonces 18914775–18914824) to delegate execution to a malicious contract, draining 167,464 ETH and $1.615B USDT. Stablecoin issuers froze roughly $3 billion; over $3 billion remains at large.