FBI busts FaceStealer crew that deepfaked trusted contacts on crypto calls

The Justice Department took down FaceStealer's cloud infrastructure, and the FBI seized more than 900 webcam videos recorded from the scheme's victims under a federal warrant. The operation pulled in more than $400 million in crypto over 18 months, DOJ said Thursday.

The con runs on stolen trust. Hackers use accounts lifted from earlier victims to invite new marks onto video calls, then play secretly recorded webcam clips of people the target actually knows. Deepfake videos of influential crypto and web3 figures, built with what DOJ called super intelligence, run in the same meetings.

Mid-call comes a bogus technical glitch, such as the target not being heard, followed by a link or prompt to fix it. That silently installs malware. From there the crew drains crypto or rides the victim's access into other systems, and DOJ says some thefts and account takeovers landed months to more than a year after the initial break-in.

Hackers mine each new victim's contact lists, social media and messaging apps to line up the next target. Open source software developers are increasingly in the crosshairs, with their devices and code repository accounts hit in what DOJ said appears designed to enable supply-chain attacks.

The FBI's Patrick Grandy, assistant director in charge of the Los Angeles Field Office, said the scheme exploits trust in everyday video platforms and personal relationships, adding that anyone who cannot picture themselves falling for it is not thinking creatively enough. The FBI published a report on how FaceStealer works, along with protection steps for victims, and stood up a FaceStealer resource website.

DOJ tied the operation to North Korean groups including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. Cryptopolitan reported in February that UNC1069 hijacked a crypto executive's Telegram account to lure a target into a fake Zoom call, faking audio trouble and getting the victim to run troubleshooting commands. The department also won court approval to seize or restrain more than $1.2 billion stolen from Binance, part of more than $2.7 billion frozen so far, blaming hackers it calls TraderTraitor for siphoning more than $6 billion from the exchange around Oct. 29. North Korea has denied involvement, and TraderTraitor is still laundering the funds through crypto bridges, mixers and exchanges while tracing and forfeiture efforts continue.