North Korean Hackers Stole $400M in Crypto Using Fake Video Calls, FBI Warns

The Federal Bureau of Investigation has warned that North Korean state-sponsored hackers stole more than $400 million in cryptocurrency using a sophisticated scheme involving staged video calls. Federal investigators revealed that the campaign targeted cryptocurrency investors, Web3 professionals, and software developers over an 18-month period. The operation represents one of the most technologically deceptive social engineering efforts documented by U.S. authorities.

Known to federal cyber investigators as the FaceStealer scheme, the operation relied on hijacked accounts across platforms such as Telegram, LinkedIn, Slack, and Discord. Attackers compromised legitimate user credentials and then contacted colleagues or associates of the victims to arrange online meetings. Because the messages originated from familiar profiles, prospective victims rarely suspected fraudulent activity prior to entering the virtual meeting rooms.

Once a target agreed to a meeting, the operatives directed them to join rogue conference rooms that closely mimicked services like Zoom, Microsoft Teams, and Google Meet. Rather than appearing directly on camera, the hackers streamed pre-recorded video clips of people the victim already knew and trusted. The deceptive footage created the illusion of an authentic business or technical discussion in progress.

While the target was focused on the simulated attendee, the malicious software surreptitiously activated and recorded the victim's webcam without authorization. Investigators determined that these recordings were systematically archived into a growing visual library. The stolen clips were then repurposed in subsequent campaigns to deceive other colleagues and business contacts in a compounding social engineering chain.

During the staged video sessions, the attackers typically simulated an artificial audio glitch or connection error to manipulate the target. They would instruct the participant to click an external link or run an update script under the guise of resolving the technical malfunction. Executing the download secretly installed specialized malware directly onto the victim's machine.

The deployed malware allowed the state-backed operatives to gain unauthorized access to digital cryptocurrency wallets and extract private cryptographic keys. Cyber experts also noted that the intrusions allowed threat actors to harvest sensitive developer credentials and target open-source software repositories. In total, the coordinated intrusions resulted in the theft of an estimated $400 million in digital assets from over 900 individual victims.

Cybersecurity researchers have linked the FaceStealer campaign to advanced persistent threat clusters previously tracked as Sapphire Sleet and UNC1069. Intelligence agencies have repeatedly warned that revenue generated from foreign cyber heists plays an integral role in financing North Korea's prohibited ballistic missile and nuclear weapons development. Digital currency thefts have increasingly evolved into a primary illicit revenue mechanism for the isolated Pyongyang regime.

In response to the sprawling cyber campaign, U.S. law enforcement agencies secured federal court orders to disrupt and seize key cloud-based infrastructure powering the attacks. As part of the operation, federal agents obtained a warrant that permitted the seizure of a digital repository containing webcam footage belonging to more than 900 victims. The action aims to prevent the stolen recordings from being weaponized in ongoing social engineering attempts.

Federal authorities and cybersecurity specialists are now urging organizations, particularly those within the decentralized finance and blockchain sectors, to implement multi-layered verification protocols. Experts recommend using secondary communication channels to verify meeting requests and exercising heightened scrutiny before executing troubleshooting scripts during calls. Security officials emphasized that public vigilance remains crucial as foreign threat actors deploy increasingly realistic video manipulation techniques.