FBI: North Korean Hackers Stole $400M in Crypto With Fake Video Calls

The FBI has issued a public warning about North Korean hackers who used fake video meetings to fleece crypto users, pulling in $400 million through a scheme it calls FaceStealer. The operation ran for more than 18 months, built on impersonated accounts and recorded webcam footage. On Nov. 12, the Justice Department and the FBI announced they had shut down the cloud infrastructure behind it.

Here's the playbook. Hackers take over social media accounts and message people connected to earlier victims, then set up video calls on imitation versions of platforms like Zoom. During the meeting they play recorded footage of someone the target recognizes, fake an audio or technical glitch, and hand over instructions to fix it. Those instructions install malware that opens up the victim's phone, accounts and potentially their crypto wallets.

The FBI recovered more than 900 webcam videos belonging to victims. The campaign targets Web3 and crypto workers along with open-source software developers, since a hijacked developer account can expose widely used projects to supply-chain attacks. According to the Bureau, the crew nearly compromised a major open-source JavaScript library early this year before the attempt was stopped.

Brett Leatherman, Cyber Branch Operations Director at the FBI, said North Korea leans on large-scale crypto theft to fund its illegal weapons program.

The alert lands after the largest crypto theft on record, involving more than $6 billion in virtual assets. Authorities and private-sector partners have frozen over $2.7 billion tied to it, and the department restrained more than $1.2 billion under court authorization, according to the report. Binance said in October it had covered 90% of the losses from the incident.

The FBI's advice to crypto fans and developers: confirm any meeting invitation through a different communication or social media channel first, and don't install software pushed by unexpected prompts.