FBI: North Korea's FaceStealer crew swipes $400M with fake video calls

FBI investigators say North Korean state-sponsored hackers ran a scheme they call FaceStealer, using fake video calls to lift cryptocurrency and identities from more than 900 victims. The crew reportedly walked away with about $400 million — £300 million — according to The Sun. The FBI says the campaign aggressively targets people working in crypto and web3, especially those who develop and maintain open-source software.

The playbook is patient. Hackers hijack social media accounts or spin up imposters, then invite their marks to calls hosted on fake versions of Zoom, Microsoft Teams and Google Meet. They play video of someone the target actually knows, fake an audio dropout, and drop a link that supposedly fixes the call. Clicking it installs malware that hands over the victim's contact list and apps — and every call gets recorded so the next target comes from a familiar face.

FBI cyber director Brett Leatherman tied the thefts straight to Pyongyang's military ambitions, saying the regime relies on large-scale crypto theft to fund its illicit weapons program. The Bureau branded FaceStealer a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user. Patrick Grandy, assistant director of the FBI's Los Angeles field office, said it exploits our trust in video conference platforms and valued personal relationships — and warned that if you can't imagine falling for it, you're not thinking creatively enough. Hackers are also reportedly starting to deploy AI-generated deepfakes of well-known crypto figures. Pyongyang has denied being behind the hacks.

The haul lands weeks after a far bigger one. Elite hackers from Lazarus Group, a North Korean state-sponsored gang, are suspected of masterminding a £4.7 billion ($6.3 billion) Binance heist that rocked the crypto market. An affiliated team, TraderTraitor, is believed to have compromised a Binance engineer's laptop and drained billions in about 20 minutes. Binance said user funds were completely safe, pledged to cover all losses, and later reported roughly $3 billion (£2.5 billion) frozen on-chain with blockchain partners. The FBI confirmed North Korea was behind TraderTraitor, which operates under Lazarus — itself answering to Kim Jong-un's Reconnaissance General Bureau and bankrolling the regime's nuclear program.