# FBI Disrupts North Korean Cyber Operations

The FBI and Department of Justice disrupted North Korean-linked cyber operations that used social engineering, recorded video calls, and compromised accounts to install malware, steal cryptocurrency, and target software developers. Officials said the broader campaign generated more than $400 million in theft; separately, DOJ obtained court authorization to seize or restrain more than $1.2 billion stolen from Binance, an amount included in—not additional to—the more than $2.7 billion frozen through public- and private-sector efforts. No solicitation or contract award was announced, but the actions highlight federal operational focus on cyber investigations, identity security, software supply-chain protection, and cryptocurrency tracing and recovery.

- Contractors and software developers should treat impersonation through trusted business workflows and compromised developer access as material cyber risks, and review relevant identity and access controls.
- The federal response points to continuing needs for threat intelligence, digital forensics, cyber investigations, and cryptocurrency tracing and recovery capabilities; firms with these capabilities can assess their fit for government work in these areas.
- No specific procurement opportunity, contract value, or procurement contact is identified in the signals.

**Jurisdictions:** federal
**Industries:** Public Safety, Information Technology
**Topics:** Cybersecurity
**Published:** November 13, 2026

### Government Entities
- Federal Bureau of Investigation (FBI)
- U.S. Department of Justice (DOJ)
- U.S. Attorney’s Office for the Central District of California

### Key Quotes
> Today, we’ve identified more than 677 targets across 58 countries. We’ve also seen the group’s social engineering playbook expand well beyond fake meetings into document-sharing platforms, identity verification requests, media content, and other trusted business workflows.
> — Justin Moore, Director of Adversary Operations, Arctic Wolf

### Sources
- [FBI disrupts intricate North Korean fake-call scheme tied to $400M in crypto theft - Nextgov/FCW](https://www.nextgov.com/cybersecurity/2026/11/fbi-disrupts-intricate-north-korean-fake-call-scheme-tied-400m-crypto-theft/417200) - Nextgov/FCW
- [FBI disrupts intricate North Korean fake-call scheme tied to $400M in crypto theft - Nextgov/FCW](https://www.fcw.com/cybersecurity/2026/11/fbi-disrupts-intricate-north-korean-fake-call-scheme-tied-400m-crypto-theft/417200) - Nextgov/FCW
- [US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance | CyberScoop](https://cyberscoop.com/us-seizes-north-korea-hacking-infrastructure-binance) - CyberScoop