North Korean hackers stole $400m with fake video calls, FBI says

North Korea-linked hackers stole more than $400 million in cryptocurrency over 18 months by luring victims onto fake video calls and tricking them into installing malware disguised as a software fix, the FBI and the US Department of Justice have said.

The scheme, announced on November 12 and dubbed "FaceStealer" by the FBI, is built on a unsettling trick: the face on the screen, apparently a colleague or contact the victim knows and trusts, is in fact secretly recorded webcam footage of an earlier victim — and the hackers are increasingly turning to AI-generated deepfakes of well-known figures in the cryptocurrency world instead.

More than 900 victims are thought to have been caught by the operation in the last 18 months. The FBI said it had seized more than 900 victim webcam videos and taken down cloud infrastructure used by the hackers under a federal warrant — a measure of how industrial in scale the operation had become.

How the fake calls worked

According to the FBI, the attackers began by sending meeting invitations from accounts they had taken over from earlier victims, so the invitation appeared to come from someone the target already knew. The links led not to the real services but to fake versions of Zoom, Microsoft Teams and Google Meet, three of the most widely used video-conferencing platforms in the world.

Once on the call, the target saw a familiar, trusted face — in reality, webcam video of a previous victim, recorded without their knowledge and replayed to give the meeting an air of legitimacy. Then came the hook: the victim was told their audio was not working, and was directed to install a software "fix" to solve the problem.

The fix was malware. Once installed, it stole cryptocurrency from the victim and harvested their contact list, giving the hackers a fresh set of trusted identities and new targets to approach. Each victim, in other words, became both a source of money and a bridge to the next victim — which helps explain how the scheme sustained itself, and grew, over a year and a half.

The targets were not random. They included people working in cryptocurrency and web3 businesses, and open-source software developers and maintainers — people likely to hold digital assets, to take online meetings with contacts they know mainly through screens, and to have contact networks full of similar targets.

Who is behind it

The FBI attributes FaceStealer to a North Korean hacking cluster it tracks as Sapphire Sleet, also known as UNC1069. The cluster is linked to a web of other names familiar to security researchers — BlueNoroff, APT38 and Stardust Chollima — sitting under the wider Lazarus umbrella, the collective label often applied to North Korea's state-backed hacking operations.

North Korea's use of cybercrime as a source of state revenue is well established, and officials were explicit about the purpose they believe lies behind this campaign. Brett Leatherman, the FBI's cyber division director, said North Korea finances its illegal weapons programme with revenue from large-scale crypto theft. Cryptocurrency is attractive for such operations because it can be moved across borders quickly, outside the controls of the conventional banking system from which North Korea is largely cut off.

The seizure of the victim webcam videos also points to how the operation renewed its own raw material: every recorded call gave the hackers another trusted face to put on a screen in front of the next target.

A much bigger theft economy

FaceStealer is only one strand of the activity described by US authorities this week. Separately, a court authorised the seizure of more than $1.2 billion that had been frozen after the October 29 theft from Binance, one of the world's largest cryptocurrency exchanges. More than $6 billion was stolen in that attack, which was attributed to a group called TraderTraitor, and more than $2.7 billion has been frozen overall.

Taken together, the numbers illustrate the scale of the problem confronting investigators and the industry. Individual deceptions measured in minutes — a meeting invitation, a familiar face, a supposed audio fault — are feeding thefts measured in the hundreds of millions, while single attacks on major platforms can run into the billions.

For the more than 900 people caught by FaceStealer, the personal cost may extend beyond what was stolen from them: their own recorded images may have been used to deceive their colleagues and contacts. And for everyone who works in the industry, the case is a reminder that the most dangerous moment in a video call may now be the moment it appears not to work — and a stranger's fix is only a click away.