US authorities say North Korean state-sponsored hackers have taken more than $400 million in cryptocurrency using fake video calls hosted over imposter versions of Zoom, Microsoft Teams and Google Meet; the FBI says more than 900 victims have fallen prey to the scheme in the last 18 months.
The bureau, which calls the campaign FaceStealer, says it has been active for the last 18 months. The scheme "aggressively targets" workers in the cryptocurrency and web3 sectors, particularly those developing and maintaining open-source software. Hackers use fake or hijacked social media accounts to invite victims onto fake video conferencing platforms, where they play pre-recorded footage of an acquaintance to simulate a legitimate call. When the audio appears to malfunction, the target is prompted to click a fix link that instead installs malware, giving the hackers access to their contacts and apps. The calls are secretly recorded and reused to scam further targets.
The announcement comes a week after Binance, the world's largest crypto exchange, revealed a record $6.3 billion hack that US authorities attributed to North Korea-linked actors, a claim Pyongyang has denied.
"The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," FBI cyber director Brett Leatherman said. "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough," added Patrick Grandy, assistant director in charge of the bureau's Los Angeles field office. "It exploits our trust in ubiquitous video conference platforms and valued personal relationships."
The FBI described FaceStealer as a highly effective social engineering scheme capable of deceiving even the most experienced technical and security-conscious computer user.
Analysis
Why This Matters
- The $400 million theft from over 900 victims highlights a highly sophisticated and scalable social engineering operation by a state actor, demonstrating how trust in routine digital tools can be weaponised.
- Proceeds from these heists are used to fund North Korea's illicit weapons programs, directly linking cybersecurity to geopolitical and non-proliferation concerns.
- The focus on cryptocurrency and web3 professionals points to a persistent, evolving threat against a specific, high-value sector of the digital economy.
Background
North Korea has long been accused by security researchers and governments of using cyber operations, including cryptocurrency theft and ransomware, to generate revenue in the face of international sanctions. The US government has previously attributed large-scale crypto heists to North Korean state-sponsored groups.
Key Perspectives
FBI: describes FaceStealer as a highly effective social engineering campaign that generated over $400 million for North Korea's weapons programs by exploiting trust in video platforms and personal relationships to target crypto professionals.
North Korean Government: has denied US claims linking it to the recent record $6.3 billion Binance hack, which authorities say was carried out by similar North Korean-linked actors.
What to Watch
- Whether international cybersecurity agencies issue coordinated alerts or sanctions targeting the Facestealer infrastructure.
- The potential for the technique to be adapted and deployed against other professional sectors.
- Continued US intelligence assessments linking major crypto thefts to North Korean weapons funding.
Checked
12 claims in this story checked against 1 source: 10 supported.
Show each claim
- SupportedThe FBI says North Korean hackers used fake video calls in a $400m cryptocurrency theft.BBC News: “North Korean hackers used fake video calls in $400m crypto hack, says FBI”
- SupportedFaceStealer targets crypto and web3 workers through imposter video apps.BBC News: “Authorities say FaceStealer, the latest scheme, "aggressively targets" those who work in the cryptocurrency and web3 sectors”
- SupportedUS authorities say North Korean state-sponsored hackers took more than $400 million in cryptocurrency using fake video calls.BBC News: “State-sponsored hackers from North Korea have taken more than $400 million in cryptocurrency by using fake video calls to steal people's identities, US authorities say.”
- SupportedThe FBI says more than 900 victims fell prey to the scheme in the last 18 months.BBC News: “More than 900 victims have fallen prey to the scheme, which the FBI refers to as FaceStealer, in the last 18 months, according to the bureau.”
- Partly supportedThe FBI says the campaign itself has been active for the last 18 months.BBC News: “More than 900 victims have fallen prey to the scheme, which the FBI refers to as FaceStealer, in the last 18 months, according to the bureau.”
- SupportedThe scheme particularly targets people developing and maintaining open-source software.BBC News: “particularly those who are involved in the development and maintenance of open-source software.”
- SupportedHackers invite potential victims to imposter video calls using fake or hijacked social accounts and play prerecorded videos of people the target knows.BBC News: “hackers use fake or hijacked social media accounts to invite potential victims into video calls hosted over "imposter versions" of Zoom, Microsoft Teams, and Google Meet. Next, the hackers play pre-recorded videos of previous victims the target is acquainted with”
- Partly supportedA prompt leads the target to click a fix link that installs malware, giving hackers access to contacts and apps.BBC News: “This "fix" would eventually download malware onto the target's device, which allows hackers to access their contact lists and apps”
- SupportedHackers secretly record the calls and reuse the recordings to scam more targets.BBC News: “Hackers would secretly record these calls and use the recordings as material to scam their new victims, according to the US authorities.”
- SupportedA week after the announcement, Binance revealed a record $6.3 billion hack attributed by US authorities to North Korea-linked actors, which Pyongyang denied.BBC News: “This comes a week after the world's largest crypto exchange Binance revealed that hackers had used fake job interviews to steal a record $6.3bn (£4.7bn) from the company. US law enforcement agencies attributed the Binance hack, thought to be the largest crypto hack to date, to North Korea-linked actors. Pyongyang has denied this claim.”
- SupportedFBI cyber director Brett Leatherman said the North Korean regime relies on large-scale crypto theft to fund its illicit weapons program and has stolen billions in recent years.BBC News: “"The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," says FBI cyber director Brett Leatherman.”
- SupportedPatrick Grandy made both quoted remarks about falling prey to the scheme and its exploitation of trust.BBC News: “"It exploits our trust in ubiquitous video conference platforms and valued personal relationships," Patrick Grandy, assistant director in charge of the bureau's Los Angeles field office, said in a statement on Thursday. "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."”
