FBI Smashes North Korean 'FaceDealer' Crew That Stole $400M From Crypto Workers

The FBI has taken down infrastructure tied to a North Korean hacking operation that turned routine video calls into a cash machine. Special agent Jeremy Robertson, who leads counterintelligence and cyber at the bureau's Los Angeles field office, laid out the scheme in a video on X and gave it a name: FaceDealer. According to Robertson, the campaign pulled in more than $400 million in thefts over just 18 months.

The playbook starts with a familiar face. Attackers messaged targets while impersonating someone the victim knew or recognized as important in the industry, often by hijacking that person's Telegram or LinkedIn account to make the contact look real. From there came a fake but convincing Zoom or Microsoft Teams meeting built and controlled entirely by the hackers.

The trap has layers. Robertson said the attackers secretly record your webcam while you sit waiting for the meeting to start, then use that footage later to impersonate you. Once inside, the victim sees video of the person who supposedly sent the invite — actually an earlier victim — while fake participants pile into the call and a message claims the other side can't hear them. Then comes a fake error message demanding an update, with everyone in the meeting waiting for you to fix it.

Running that update installs malware, handing the attackers access to the victim's computer, crypto wallets and social media accounts. Robertson said the FBI found and disrupted videos from more than 900 victims, all experienced professionals in crypto, Web3 and cybersecurity. His warning to anyone who thinks they'd spot the trick: don't be sure, calling it a highly effective social engineering scheme.

It's not the FBI's first accusation aimed at Pyongyang. Last month the bureau tied a $6.3 billion Binance breach to a DPRK cyber campaign known as TraderTraitor, and said the attackers were converting stolen funds into ETH and pushing them through DeFi platforms and instant swap services. North Korean officials have rejected the allegations outright, dismissing them as absurd rhetoric and suggesting the US stood to gain most, since recovered funds could be confiscated into its national strategic reserve.