FBI says North Korean hackers stole more than $400 million in cryptocurrency through ...

The FBI tied a North Korean social engineering campaign known as FaceStealer to more than $400 million in cryptocurrency theft over 18 months, as U.S. authorities seized infrastructure and moved to restrain more than $1.2 billion stolen in a separate Binance hack.

The U.S. Federal Bureau of Investigation (FBI) said threat actors linked to North Korea stole more than $400 million in cryptocurrency over the past 18 months through a social engineering campaign known as FaceStealer. U.S. authorities seized cloud infrastructure tied to the operation and announced court-authorized actions to restrain more than $1.2 billion in cryptocurrency stolen in a separate Binance hack attributed to the North Korea-linked TraderTraitor group.

The U.S. Department of Justice said the stolen assets support Pyongyang's weapons program. "The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," Brett Leatherman, director of the FBI Cyber Branch, said in a statement.

How FaceStealer works

Investigators said FaceStealer uses recorded videos and deepfakes to gain a target's trust during video meetings. The campaign shares traits with activity that Kaspersky documented as GhostCall in October 2025. The FBI linked the operation to BlueNoroff, a financially motivated North Korean cluster also tracked as APT38, Sapphire Sleet and Stardust Chollima.

The attackers start by taking over accounts that belong to earlier victims. They people in the victim's network and propose a video meeting, often framed around an investment discussion. Before the call, they send a scheduling link and then a meeting link that imitates Zoom or Microsoft Teams . Researchers at JUMPSEC identified typosquatted domains used in the campaign, including uu01webzoom[.]us and teams.livemeet[.]us .

When the target joins, the attackers play a prerecorded webcam video of the trusted or synthetic footage of known figures in the cryptocurrency and Web3 sectors. The Justice Department said the group uses generative tools to produce deepfake videos and static avatar images that make the call appear legitimate. Seconds into the meeting, the host claims the target has an audio problem or needs a software update. The fix directs the victim to run a command or install a file, a ClickFix-style lure that places malware on the device and gives the attackers access to cryptocurrency wallets, credentials and connected systems.

A self-spreading campaign

JUMPSEC described FaceStealer as a platform that turns each compromise into the round of outreach. After attackers gain control of a device, they harvest wallet data and seed phrases, lock the victim out of messaging accounts and mine lists from services such as Telegram, , Slack and Discord. They then use those relationships to invite new targets to fake meetings and repeat the cycle.

The FBI said it seized more than 900 victim webcam recordings that attackers planned to reuse in future impersonation attempts. The agency warned that North Korean hackers continue to target software developers, maintainers and libraries with large download counts. The Justice Department said attackers used the FaceStealer scheme to target a maintainer of the Axios npm package earlier this year and push a trojanized version, showing how social engineering against one developer can expose a wider software supply chain.

Arctic Wolf reported in April 2026 that the campaign targeted more than 400 people in more than 20 countries, with many targets in the United States, Singapore, the United Kingdom, Hong Kong, South Korea and the United Arab Emirates. The company said 80% of identified targets worked in cryptocurrency, blockchain finance or adjacent investment sectors, and chief executives and founders accounted for 45% of the set. Arctic Wolf later identified 677 targets across 58 countries, with founders and C-suite executives making up more than 80%. The researchers said the attackers expanded reconnaissance to YouTube interviews and conference talks and used generative tools from ChatGPT, Google, xAI's Grok and Wondershare to produce lures and synthetic meeting content.

FaceStealer operates alongside a separate North Korean campaign known as Contagious Interview, which uses fake job offers and technical assessments to deliver malware. A joint advisory from cybersecurity and intelligence agencies in Japan, the United States, Australia and Germany estimated in September 2026 that the campaign compromised at least 30,000 devices in 100 countries.

Alina Krasavina, an engineering manager at Delivery Hero, described receiving two fake recruiter approaches on the same day in October 2026. One included a coding project with a hidden backdoor. The other pushed her during a video call to her screen, download a repository and run it.

Sophos reported that an employee's corporate macOS device ran malware for 26 hours in September 2026 after the employee opened a public repository presented as a coding assignment in Visual Studio Code . A weaponized workspace setting replaced the terminal profile and triggered a chain that delivered the BeaverTail loader and the InvisibleFerret backdoor. Sophos said the incident affected no products, services or customer data.

Steps organizations can take

The campaigns rely on trusted relationships, familiar meeting tools and pressure to solve a technical problem fast. Security teams and individuals in cryptocurrency, finance and software development can reduce exposure with a few checks:

Confirm meeting links through a separate channel before joining, especially when a sends a link on short notice or from a domain that differs from the official service.

Treat requests to run commands, install updates or copy code during a call as a warning sign. Close the session and verify the request with the through another method.

Open interview assignments, unknown repositories and downloaded files in a disposable virtual machine instead of a work device. JFrog researchers advised employers to set this rule after uncovering a decoy company, AccuraSoftHire, that used a careers site, job ads and verified recruiter profiles to distribute malicious assessments.

Review account access for messaging, code hosting and wallet infrastructure. Limit permissions, require strong authentication and monitor for signs that an attacker controls a trusted account.

The FBI asked potential victims and organizations with relevant information to report incidents through its Internet Crime Complaint Center at ic3.gov .

Source : FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls , by The Hacker News , The Hacker News , Nov 13, 2026