North Korean Hackers Stole $400 Million in Crypto via Fake Video Calls

By James Calloway

US authorities have seized a cloud-based infrastructure used by North Korean hackers who stole $400 million (about R$2.2 billion) in cryptocurrencies over the past 18 months, the Department of Justice announced Thursday. The FBI issued an industry alert the same day, naming the social-engineering scheme FaceStealer.

Who is behind the FaceStealer scheme?

The FBI says the hackers allegedly operate with backing from the North Korean government. Investigators have tracked them under several names: Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.

Their playbook starts with familiar tools. The scheme relies on fake versions of popular video-call apps such as Zoom, Microsoft Teams and Google Meets.

"The targets are lured into fake videoconferences by invitations from genuine communication and social media accounts hijacked from previous victims," the FBI said in its bulletin.

Those stolen accounts came from platforms including Telegram, LinkedIn, Slack and Discord. When new victims joined a call, the hackers played pre-recorded videos of earlier victims in similar meetings, creating the impression of a legitimate encounter.

How did the malware get in?

Access came through a staged technical failure. A supposed error would interrupt the videoconference. Still impersonating someone the victim knew, the hackers offered a fix and walked them through instructions. That was the moment malware landed on the victim's device.

"With the victim's computer compromised, the North Korean hackers can steal accessible cryptocurrencies or exploit the victim's access to external infrastructures, such as an employer's network or an open-source software maintainer's account," the FBI explained.

The scale is striking. The FBI says webcam footage of more than 900 employees in the sector was used in the scam.

Deepfakes played a supporting role. According to the FBI, artificial intelligence systems generated fake videos of known and influential figures in the crypto industry, artificially inserting them into videoconferences to build credibility.

"The quality of the deepfakes only needs to be good enough to pass as webcam video," the FBI said. Investigators stressed, however, that account theft and genuine recordings made up the bulk of the scheme — not AI.

The takeaway: the biggest vulnerability wasn't synthetic video, it was hijacked trust inside apps people already use daily.

What about the Binance recovery?

The FBI alert landed on the same day the Justice Department announced it had recovered $1.2 billion in digital coins stolen from exchange Binance. American authorities also attributed that attack to North Korean criminals.

"Unfortunately, cryptocurrencies have become fertile ground for North Korea to defraud victims and finance its nefarious activities," said Bill Essayli, first assistant US attorney for the Central District of California.

Prosecutors said the North Korean government funds "its pariah regime and its illicit weapons program through cryptocurrency theft." The hackers who took the Binance assets are described as "members of the North Korean military."

The billion-dollar freeze only covers part of the damage. The criminal operation stole a total of $6.3 billion in cryptocurrencies from Binance in the late-October attack, meaning roughly $5.1 billion remains unrecovered — and the same tradecraft that emptied that exchange is still hunting its next video call.